We have 2FA for the staff interface, it would be nice to have it for the OPAC too. It should probably be a separate options, so 2FA can be enabled/enforced separately for the staff interface and for the OPAC.