Just one gripe: I absolutely do not think it's a good idea to have zero-touch ON by default. I understand their argument about security vs. usability for laype

Just one gripe: I absolutely do not think it's a good idea to have zero-touch ON by default. I understand their argument about security vs. usability for laypeople as it's an age old one, but I think that applies better to situations where there's a marked tradeoff in principle. Tapping just once or reaching for one's phone doesn't detract from usability. Quite the contrary, it's a common sense approach (and teaches common sense security posture) to give one's explicit agreement for authentication, U2F or otherwise. Otherwise, the intended user base that zero-touch seems to target may end up being the same folks that question why it didn't work out of the box to protect their logins when their laptop gets physically compromised; since they assumed they didn't have to "understand or care about the differences between two-factor, U2F, or web authentication" in the first place, to quote the FAQ.