“Let’s see how it can be set up on your consumer-grade Mac.”
A Secure Enclave SSH key that asks for Touch ID on every use is the right idea. Apple ships the pieces and documents almost none of them. The key dies with the Mac. Keep a second one somewhere else.