i did not notice until skimming this arch wiki page that it is now possible to have both MFA or pam auth in general and key auth both required at the same time to authenticate, great!
I made a mistake once setting this up and I managed to have password AND key and MFA. This was a misconfiguration but might be useful for some use-cases. So it’s good to know it’s not either/or.