Optional two factor authentication for the staff client would be A Very Good Thing, especially in light of GDPR in Europe.
There are plenty of ways to implement 2FA I guess (see the "Depends on" for this bug), so getting a system in place that could easily be extended with plugins would be super awesome.
Is there an issue with using a pre-existing tool such as PrivacyIDEA (https://github.com/privacyidea/privacyidea) that already does 2FA (in lots of different forms)? Does it really need to be rolled into the Koha code base, rather than allowing sysadmins to use external 2FA support? They might need to do anyway if their Koha installation is just one small service in a much larger organisation that already uses 2FA, so if it was bolted inside Koha it would need to be done in a way that could be turned off if external 2FA services were being used. Just for completeness I should mention that we've tested PrivacyIDEA 2FA with YubiKeys tied into SAML2.0 authentication using simpleSAMLphp as the IdP and it works OK. Not deployed in production yet as someone would have to come up with a budget for all the Yubikeys we'd need!
I am not a 2FA expert, so whatever works is fine by me. Does implementing support for external 2FA mean we can not implement internal 2FA? If not, I think we should be open to both solutions.
So long as the two factor authentication is optional, I think this is a great idea.