> I don't think an apple watch would help there?

You can authorize via Apple Watch everything you can authorize via Touch ID. You get the notification on the Watch, and you need to press the button twice to auth.

I don't remember if it works every time, or only when MacBook is closed and connected to external display/keyboard.