Hey, I finally just figured out why there is no 802.11 "pre-association" feature for normal WPA2-PSK, even though this exists if you're using "WPA2 Enterprise" aka EAP.
It's because the latter might take a long time and so it's worth doing in advance. WPA2-PSK takes about 20ms, so nobody cares. (It takes several seconds to scan all the channels to see who you want to associate with, though.)
ssh+2FA to all your machines, anywhere, without opening firewall ports.