Oh thanks for mentioning [4], I always thought 2FA using PAM disabled the key-based authentication and used passwords.