"Note: It looks like leadership has stated this shouldn’t be the solution."
I call this confident decision making. Well, I think I do. Well, it looks like I do. It looks like someone does. Okay, it looks like someone doesn't not. But anyway, I think we have a solution. Not this one though.
ssh+2FA to all your machines, anywhere, without opening firewall ports.