Change the standard passwords:

# important, for security reasons you usually cant change a thing!
rw
kvmd-htpasswd set admin
passwd # changes the root password

Set up 2FA:

rw && pacman -Syu && reboot
# reboots, is in ro mode after that
timedatectl
# check that the time is synced with a timeserver
#               Local time: Mi 2023-04-12 11:43:19 CEST
#           Universal time: Mi 2023-04-12 09:43:19 UTC
#                 RTC time: Mi 2023-04-12 09:43:19
#                Time zone: Europe/Vienna (CEST, +0200)
#System clock synchronized: yes
#              NTP service: active
#          RTC in local TZ: no
rw
kvmd-totp init
ro