There is already a standard solution for this imo. Get a GPG smartcard like a Yubikey and put an Authentication subkey on it.<p>Now to ssh to anything, clone from Github, etc you insert your Yubikey, and enter your pin to unlock it. A gpg-agent process is created that acts as a standard ssh agent.<p>No server modifications required and you get strong hardware backed 2FA. The ssh private key never enters system memory and could not be stolen even by an untrusted machine.<p>If the smartcard itself is stolen, it will brick itself on 3 incorrect pin attempts.<p>The same device can also store all your OTP tokens or behave as U2F depending on what a service supports so the end game is secrets no longer live on disk or in memory on your systems.<p>This also integrates well on Android devices via the Yubikey Neo with apps like Yubico Authenticator and Open Keychain,