> based on public/private key pairs I said it many times and I'll say it again: this can't possibly work in the real world, period. People are notoriously terr

> based on public/private key pairs I said it many times and I'll say it again: this can't possibly work in the real world, period. People are notoriously terrible with passwords already. So terrible in fact that VKontakte (I worked there, both with Pavel and after he was ousted) had, and still has, a department dedicated to account recovery. And those are passwords, short strings that you can actually remember. You can't possibly expect an average person to keep their private key (a file you can't store in your head) absolutely secret and never lose it at the same time. In my world, the ability to recover your account if you lose everything is a hard requirement for any product that is meant to reach mass adoption. The ability to revoke access is also a hard requirement. People share their credentials — it's a fact of life. In the usual setup, you can change your password and terminate sessions. But if your private key is your identity, you can't do shit to prevent someone who has gained access to it from impersonating you for the rest of eternity.