If you're running a recent version of OpenSSH, you can add the 'ForceCommand' param to sshd_config to add it for all users. The only downside to this is it is for all users, so if you run something that needs to use key based login without the two factor method you'll need to validate that yourself within the script.
it seems to me that you're doing 2 factor on the ssh key decryption. That's not so useful IMO from the security point of view.
The factor should be an alternative to the ssh key itself aka server side aka via ForceCommand as suggested
