I wrote a tiny node app wrapped as a single binary as a second factor for ssh public key login using pam_exec.so. It posts a Telegram poll, "allow login to server x as user y from ip z?" Yes/No with a 30second timeout to a private group. A simple way to add some additional protection.