I generally agree, but I do see cause to believe there is the possibility of light at the end of the tunnel. Microsoft is starting to push passwordless feature

I generally agree, but I do see cause to believe there is the possibility of light at the end of the tunnel. Microsoft is starting to push passwordless features for Windows and online accounts. YubiKeys and OTP apps are pretty common (hopefully there will be more standardization and less fracturing of those features). OAUTH2 is mature and Google/Facebook/GitHub/etc all work decently as providers. Although I wish a single government entity would replace those OAUTH providers. I can't get banned by my state like I can get banned by Google for ToS violations, so I'm wary of creating a federated auth account unless I'm certain I can't lose access to the root account without necessarily losing access to the subservient accounts. The obvious downside is that dissidents and criminals are easily identified, but that's an offline problem as well as an online.