Specifically these two sentences are hard to understand:
Hey the other day you said you said that the downloaded certificate is one factor, so with the password, that's already two factors, and the rotating token would be three.
But the CTO is confused then -- how was the certificate securely transmitted in the first place, to the point that we can count it as a second factor?
They are complex sentences. This makes them hard to understand.
The email's reading level is at grade 11 on the Flesch-Kincaid scale. [1] Anything above 9 is considered "Fairly difficult to read". Best selling authors tend to score less than 9. A lot less.
You don't need to write emails like you were a best selling author of course. That's silly. But it helps if you write them for the recipient. Don't just word vomit your train of thought.
Here's how I'd write your email (from what I can guess/understand of the situation):
Hey,
The other day we talked about auth factors in our app. You said the certificate was one factor.
Adding the password, that makes two. A rotating token would make three.
Do we really need the rotating token, then?
But the CTO is confused: how do we know the certificate transmitted securely? It can't be an auth factor if we're not sure.
Cheers,
~Bla
That said, we have way over-analyzed your email :)
[1] https://en.wikipedia.org/wiki/Flesch%E2%80%93Kincaid_readabi...
[2] https://contently.com/strategist/2015/01/28/this-surprising-...