Yes, MFA is planned for on-prem controllers. We have some other milestones coming up first though. And on a side note, the answer is yes, Passkey support is also planned (for both on-prem and cloud), but that would be a later date than adding TOTP support to local instances.