Right. My point was only that most people may want a lost-password fallback; this scheme doesn't prevent implementers from providing that, so it's not really a

Right. My point was only that most people may want a lost-password fallback; this scheme doesn't prevent implementers from providing that, so it's not really a big deal.