Yes, the current rules aren't attempting to litigate full supply chain security. If you look at how the cloud signing services work though, the underlying proto

Yes, the current rules aren't attempting to litigate full supply chain security. If you look at how the cloud signing services work though, the underlying protocols are designed to allow 2FA authenticators. They give you a TOTP seed, it's not just a basic password. They can't prove the seed was put into a real 2FA authenticator app though, so in practice you can use it as if it's a password.