I've been testing the 2FA Koha module, I noticed there's currently no option to "trust current device" something that most MFA modules include, so a user can mark a local device to be excluded from the MFA check for an amount of time (typically a month or so). Not very essential, but would be a nice quality of life feature for users with dedicated machines.
This is definitely a quality of life feature that our libraries would appreciate. We have had this feedback a few times since MFA implementation has become a requirement in UK public sector systems.
I reckon this would be easy enough to add. This is a good example of where a "borrowers_credentials" table would be great, as we could store a "mfa_token". And then the user could have a cookie with that token.