Pluggable two-factor authentication.

Include it in your paster.ini configuration with:

arche.includes =
   arche_2fa

It's a good idea to hide any links to the regular login form, since users need to go through the 2fa form first.