I've been using client certs for my self hosted stuff as a MFA (what you have) and it's fairly straightforward to implement. It's annoying to manage all the certs but once it's set up, it sort of runs on its own.