I recently had to sign up for login.gov (to renew my Global Entry, after they moved away from their own one-off CBP login system) and was pleasantly surprised with how good it was. Hopefully the TreasuryDirect.gov folks migrate some day
You can use a CAC card as your second factor with the mandatory 2FA, but if you don't have one I think Yubikey-type devices are the only other hardware auth option
