[technion]

This actually rules out a substantive number of registrars. I have a statement from an account manager at our wholesale supplier arguing that the requirement to know both the email address and password is considered "two factor" in the industry.

I don't see why offering MFA hasn't been made a requirement in order to be an accredited domain registrar.