See design [RFD 0234: In-Band MFA for SSH Sessions](https://github.com/gravitational/teleport/blob/master/rfd/0234-in-band-mfa-ssh-sessions.md)
