> so that does mean once i have access to the computer the keys are somewhat free to use. thus i am authenticating the device not the user which is kind of an i

> so that does mean once i have access to the computer the keys are somewhat free to use. thus i am authenticating the device not the user which is kind of an important distinction... Isn't that the case with a U2F key? Since you observe how easy it is to fool a fingerprint scanner, is there any technology that enables you to authenticate a user at all? Password managers make passwords effectively an authentication of a device, not a person, in any case when the password is improbable enough to be secure. Maybe iris scanners work for you? Really, all we can do is make it harder for people to steal an authentication device (gmail password, ~/.ssh/id_rsa, tpm module in laptop, yubikey, whatever) and easier for people to understand in their gut that they need to protect this from theft. Am I wrong?