So, just checking in case I am being dumb, HOTP (like TOTP) works where both parties have shared secret key (common in corporate remote logins). The value here

So, just checking in case I am being dumb, HOTP (like TOTP) works where both parties have shared secret key (common in corporate remote logins). The value here being that I can make my own secret key, and via FHE send the server a "cloaked" key that they will get the right answer without knowing my secret. So apart from the initial key sharing, it's down to me to keep the key safe (as you say, pushing risk into the consumer like debit cards) Feels like it where FIDO goes next.