There is no such thing as “quick and easy” when it comes to setting up and configuring these sorts of services, and most importantly understanding them. If you think OH is hard to learn you haven’t seen anything yet. And if you want to be secure you have to understand them.
But you just said you are already using key files so you already have certificates. What more are you looking for? If you want two factor, put a password on the certificate file so the user needs a password and the decrypted certificate file (2 factors).
But, once again, you will get little to no actionable advice on this forum. You need to go to the experts.