Somehow this seems to say distrust the user. I get the drawbacks that the user is the weakest link here. However, is there still a method to trust the user to h

Somehow this seems to say distrust the user. I get the drawbacks that the user is the weakest link here. However, is there still a method to trust the user to hold the data even if they don't know the secret during the authentication. For instance, I have very long complicated generated in a password manager. I still have ownership over the passwords and in a sense the user is still trusted even if they don't have those passwords/secret memorized. I don't think for the average user a hardware token is going to become mainstream, nor do I think biometrics is appropriate due to the privacy aspect and spoofing techniques.