I hope it works with 2 factor auth (like TOTP) for applications too. Perhaps it's a bit outside of the protocol scope, but a "best practice" suggestion would be great.
This is something we'll gain more experience with at FastMail over the coming year. We'll be sure to share that experience.