One of the best features of Clef was its out-of-band authentication. The Clef servers played a big role in helping to authenticate users (explicitly using the cryptographic features of users' mobile devices do to so). As great as the 2FA plugins recommended in the migration guide are, this is a feature they all lack.

Instead, I urge those looking for a replacement to take a long look at either Tozny or LaunchKey. (Full disclosure: I work for Tozny.) Both services support two-factor authentication by way of out-of-band verification using strong cryptography on users' mobile devices. In other words, they're more solid replacements for Clef than merely depending on tools like Google Authenticator (which is also a solid tool, but an entirely different use case).

Both services offer WordPress plugins that make integrating with the CMS super easy. They both also offer developer APIs that allow you to take authentication to the next level by adding even further security to your site. SMS-based one-time passwords, email-based magic links, etc.

I'm fairly confident the teams at either service would be more than willing to help you make a migration well before the June 6th cutoff date for Clef.