Yeah that would work fine. I'm not familiar with keycloak specifically, but in general, it's pretty straightforward to replace Biff's out-of-the-box authentication method (email signin links) with whatever you want. And I'm assuming that most/a lot of people will want to do that sooner or later.