there are no plans for MFA because it should not be necessary: look at other implementations and you'll see that they all use a token that has to be generated once for each application and then that token is used for authentication.
As for SSO, this already works with mod_auth_sspi. And it should work with other ntlm/sspi modules as well, e.g. mod_authn_ntlm and maybe others.