No wonder things didn't make any sense!
UI design isn't specification, it's design. You'd think I would have guessed from the name.
That makes a big difference in how you should approach it.
Backdate (2005/10/05): Not really an update, but it appears I was thinking of this same stuff about a year ago, without coming to an answer. Spooky.
ssh+2FA to all your machines, anywhere, without opening firewall ports.