2FA is a pain in the ass and provides minimal extra security. The reason why companies employ it is because their users are incompetent and will install malware

2FA is a pain in the ass and provides minimal extra security. The reason why companies employ it is because their users are incompetent and will install malware on their desktop OS, so they shift the burden of security to locked-down mobile operating systems like Android and iOS. If an experienced user does not want to use 2FA, they will run the 2FA app in a virtual machine and automate it. You can't force them to 2FA but you can inconvenience them and tie them down to a phone number, SMS, or locked-down hardware (through remote attestation). >Letsencrypt was a boon to the web. Letsencrypt and the existing PKI structure just forces everyone's eggs into a single basket, Ripe for exploitation from the government.