Customer is looking for 2 factor authentication on MC9190's running WM/CE. They are currently using EAP/TLS with a user certificate for the 1st level of authentication. THey are looking for a second level prior to logging into their Telnet server. THey are on a Microsoft domain so perhaps some type of Doma authentication could be the 2nd level. They also have SOTI as MDM.
If not an option in Windows Mobile, perhaps Android would be a better  option.