Two-factor before releasing a domain

Given domains are valuable, please require 2FA (or at least email confirmation) before a transfer-out or registrant change goes through. It'd give me peace of mind that a compromised login can't just walk off with my names.