How so? The private key never leaves the device, the certificates are site-based, preventing phishing, and they require actual physical interaction to authentic

How so? The private key never leaves the device, the certificates are site-based, preventing phishing, and they require actual physical interaction to authenticate. This is miles better than password-based login.