I don't have an easy answer, but the "just use google drive" advice has always struck me as "create a workflow that sees lots of google logins" which exacerbate

I don't have an easy answer, but the "just use google drive" advice has always struck me as "create a workflow that sees lots of google logins" which exacerbates phishing. I think U2F probably helps a lot here, but I would really push to move away from web based workflows. It puts a lot of really dangerous UI all in the same window. In a world where people use Outlook (or pine, harhar) they don't type their all powerful email password into the browser because why the hell would the browser ever ask for the email password. But I think that ship has sunk.