My personal opinion: it's enough and you should recommend it on Google & Facebook, particularly to protect against phishing, and especially to non-tech people.

My personal opinion: it's enough and you should recommend it on Google & Facebook, particularly to protect against phishing, and especially to non-tech people. Security keys are supported on Google and Facebook on (almost) all browser/devices. Almost means you still need to be a bit careful when you buy the key to check exactly the support, but you'll find the right combination that works for you. If you want some extra websites, you also have Twitter, Dropbox, Github, etc. This said, I personally wouldn't want to enable my security keys on too many websites, because loosing or breaking a key it's a major pain. I much prefer to use oauth and delegate authentication to Google or Facebook, and keep these two highly protected.