If you are actually targeted by the government they'll pwn you with zero days on your browser or whatever. No authentication scheme will save you at that point.

If you are actually targeted by the government they'll pwn you with zero days on your browser or whatever. No authentication scheme will save you at that point. Real users should protect against credential stuffing and, if they can manage it, phishing.