Kratos doesn't appear to be an OAuth provider, but Hydra does.

Yes - Hydra is an OAuth 2.0 and OIDC provider. Kratos is an identity management system that takes care of many acccount management and account flows for you (including OAuth2 & OIDC for external providers). There's support for 2FA since 0.8 so it sounds like it might fit your use case The two are not mutually exclusive :)

Right it's the external part. If it could be the provider, that would work.