The nice thing is that in the default config you don't need two-factor auth when using public-key auth.

So from your trusted terminal you use public-key auth, and only from untrusted terminals you need to use two-factor auth.