That's the trade-off between security for the masses and savvy individuals having more control. A person can't get phished for their credentials if they can't a

That's the trade-off between security for the masses and savvy individuals having more control. A person can't get phished for their credentials if they can't access the private key. Journalists have emailed their GPG private key when learning how to use it. Even TOTP can be beat with fake webpages or a social engineer who asks for the code.