We don't currently have an API to achieve this, but we have implemented a simple kind of MFA internally in our SSH core that you could adopt as well (perhaps with a bit of tweaking to make it suitable for your scenario). One of my colleagues will contact you soon to discuss the details and pricing.