I have been using KeePass password manager, and one option for login is a password + a key file. Would it be possible to incorporate this layer of protection to monero-wallet-cli as a safer alternative than just a password, yet less safe than cold storage?
What additional level of security does this key file requirement provide?
This is not a direct answer to your question, but instead another very security conscience approach that already has working code.
Hardware HD cryptocurrency wallets such as Trezor is a two factor device that is immune to key loggers. The Monero Team now has Monero functioning binary code for Trezor devices and its source code posted here. The code is experimental at the moment, but my testing indicates it is stable.
Additionally, the Trezor Password Manager is also very likely to be more secure than Keepass for managing symmetric personal website account passwords passwords. Trezor also recently started to support U2F.
I think what you are referring to is called a multi-step authentication scheme.
From this SE post :
Two-factor authentication refers specifically and exclusively to authentication mechanisms where the two authentication elements fall under different categories with respect to "something you have", "something you are", and "something you know".
A multi-step authentication scheme which requires two physical keys, or two passwords, or two forms of biometric identification is not two-factor, but the two steps may be valuable nonetheless.
A good example of this is the two-step authentication required by Gmail. After providing the password you've memorized, you're required to also provide the one-time password displayed on your phone. While the phone may appear to be "something you have", from a security perspective it's still "something you know". This is because the key to the authentication isn't the device itself, but rather information stored on the device which could in theory be copied by an attacker. So, by copying both your memorized password and the OTP configuration, an attacker could successfully impersonate you without actually stealing anything physical.
The point to multi-factor authentication, and the reason for the strict distinction, is that the attacker must successfully pull off two different types of theft to impersonate you: he must acquire both your knowledge and your physical device, for example. In the case of multi-step (but not multi-factor), the attacker needs only to only pull off one type of theft, just multiple times. So for example he needs to steal two pieces of information, but no physical objects.
The type of multi-step authentication provided by Google or Facebook or Twitter is still strong enough to thwart most attackers, but from a purist point of view, it technically isn't multi-factor authentication
