We really should have public keys that we can give away to these sites, and then there should be a challenge/response phase that our private keys (stored safely

We really should have public keys that we can give away to these sites, and then there should be a challenge/response phase that our private keys (stored safely!) are used to sign the challenge. Of course that would mean you carrying around a physical token that needed to talk to your browser(s), phone(s) etc. Passwords should GTFO tbh.