Keyman should support setting a preferred MFA factor in the config file and as a command-line option.