Hello. I recently acquired a Surface Go (1st gen, 4 GB RAM, 64 GB EMMC) and installed Fedora Workstation (and Phosh as a second DE). I do not have a keyboard for this device, so usually, I have to use the on-screen keyboard. Entering a sufficiently secure password whenever I wake it from sleep or need elevated permissions/sudo is not practical, but I don't think a 6-8 digit numerical PIN is sufficient.

The Surface supports Windows Hello, but neither the vanilla nor the Linux-Surface kernel currently supports the IR camera. On my main laptop, I use a fingerprint sensor. I must use my good password to decrypt the drive (though this is bypassed by TPM) and unlock the keychain on first boot or after logging out, but afterwards, I can use my fingerprint to unlock from sleep, run sudo commands, and elevate my permissions.

It seems like there are PAM modules for smart keys and TOTP 2FA, though the latter is more cumbersome, and I don't know if I can authenticate FIDO or U2F from my phone over Bluetooth. I asked on the Linux-Surface matrix, and someone suggested KDE/GS Connect, which allows commands, but I would want something I could do near-instantly, either with a prompt or homescreen shortcut plus smartphone biometrics, and I want to be able to authenticate while logged in, i.e. for sudo, not just unlocking the homescreen.

I am not an expert, and security is not something I really want to go in blind on. Does anyone have experience, ideas, guidance or an up-to-date tutorial? I feel this is an acceptable compromise between usability and security, and it would make using it casually much easier.