I've been using client certs for my self hosted stuff as a MFA (what you have) and it's fairly straightforward to implement. It's annoying to manage all the certs but once it's set up, it sort of runs on its own.

Mainly just ddns on my asus router and my asustor Nas secure log in to the devices and I think some of the apps also use the one generated in the nas for log in.