hello, thanks
with my old router, OPNSense, i used 2FA/MFA for:
— web login to router
— client vpn to openvpn server
and i use keepass to auto-type all that info
and i have read about using MFA for ssh access
https://openwrt.org/docs/guide-user/services/ssh/ssh.mfa.auth
I like the idea for having it on the UI, or even go beyond with fido which you see on yubikeys, although im not sure if that is possible on local level since I believe the fido applet derives the public key from the domain, but OTP is fine.
but then you also have to implement it on luci aswell, since in some firmwares thats installed default next to it.