FIDO2 etc are widely supported, it is just that their usage is a pain in the ass. Like PGP, the tools to use them suck. Especially for non-technical people, the

FIDO2 etc are widely supported, it is just that their usage is a pain in the ass. Like PGP, the tools to use them suck. Especially for non-technical people, they just won't use them. The real solution is to make using them transparent, which hasn't been solved and there isn't enough uptake for anyone to fix it, because the easy option is to just reuse passwords. Once security keys are that easy, then they'll be used. Even if you use a password manager to generate a 100 char password, who the hell is going to type that into a phone? no one, if they can't find a solution simply, they simply won't use it.