we use signed certs with authorized principals to manage access [1] and sign the certs after successful MFA. if you need a non-interactive connection you can use token authentication to fetch a cert.

[1] https://engineering.fb.com/security/scalable-and-secure-acce...