Are you referring to something like SRP+DSS|RSA? Not widely supported but I've used it via gnutls as a custom auth proxy layer for various things. 1password uses something like this iirc.

A really simple TFA pattern with SSL enabling is requiring a signed client cert with additional directory services auth (or even basic auth).