Oh come on: you may make a point of users not caring about security, but in essence it all comes to the entities that actually care: banks, who need to prove it

Oh come on: you may make a point of users not caring about security, but in essence it all comes to the entities that actually care: banks, who need to prove it was user's fault; government, whose voters are not going to vote for the president who could not deliver a safe government; shops who pay for chargebacks... Why don't we just stop trying to make users remember all of the safety measures they've got to take care of (which by the way sound to a layperson more like a cargo cult rather than a genuine problem), and implement proper public-key authentication on all of the websites? Identity theft is a problem - that's true. But the solution is the practical one and not ideological.