[bluecmd]

There are a few. https://github.com/tink-ab/login-service is one I wrote and open sourced when I worked at the associated company. Adding something like https://github.com/dhtech/authservice + https://github.com/dhtech/prodaccess would give you client certificate provisioning and handling.

In the end you'd easily get e.g. daily U2F with monthly cert rotation. Or whatever you end up wanting.

Open source have had this convered for years, but you'll have to look for it.

Disclosure: I'm the main author of all those three projects.