I believe this was attempted, but they were running an older version of openSSH that was only getting security patches. OTP was not being triggered if an SSH key was used. so it was either password + OTP or ssh-key alone. They opted to disable ssh-key auth as the solution