As mentioned in RFD 131, tctl edit is a special case where we may want to prompt for MFA before opening the editor instead of before performing the Update. This will avoid an awkward UX that might lead to users losing edits due to failed MFA challenges after the edits are complete.

Additionally, some edits rely on resource secrets and need to prompt before the edit either way (tctl edit tokens, tctl edit cert_authority).