there's a PAM that you can install that lets you use your Watch for superuser actions. i uninstalled it some years ago because it got kind-of old and Watch authentication is buggy anyway.