We use user certificates as a second authentication factor, these are stored in the My Certificates (Key Chain) on OSX and under Windows Personal Certificates on Windows. These certificates are pushed via MDM and are not exportable. We have configured the Firefox setting the key "about:config", "security.enterprise_roots.enabled" to TRUE, but this only works for "System" not User based.