2FA variant of https://phabricator.wikimedia.org/T229264
@Mhurd, do you think this ticket needs more info before it can be moved to Eng sync?