[throwaway1974]

Revenue website here in Ireland does this, you need to have a cert which is read by a java applet, cert is issued after you use a one time password mailed to your home from what i remember, they expire every so often and need to be renewed.

One of the banking sites did as well but dropped it, now my gmail is more secure than my bank account since there is no 2fa on this bank.

The java applet approach must cause endless customer support requests