Yeah, I don't like this approach either. There was a lot of plumbing added to sshd to support pluggable auth methods, and having used a few of them (including TOTP, for instance), I am not really a fan of "extending" publickey.
(Am also not really a fan of having to eventually use a browser for authenticating a terminal session, but that's another problem.)
IDK if there was an alternative. But that's how it worked at a previous employer. You'd ssh, a tab would open in your browser, and you'd need to approve the connection. But this doc I found suggests that's my experience is just how it works (very end)[0]. But note that it says legacy (it did not previously when I was using it)
not just a browser - but coupled with the javascript-as-an-operatingsystem which first assumes you are a bot, but then you prove to it that you are not. lol
They reject the proofs now: they just show the spinner spinning indefinitely now. CloudFlare is broken and it has widespread so much that it looks like a cancer.
(Am also not really a fan of having to eventually use a browser for authenticating a terminal session, but that's another problem.)