This is public-key-crypto-based authentication for the average user who will almost certainly never buy a security key but who probably owns a device that offer

This is public-key-crypto-based authentication for the average user who will almost certainly never buy a security key but who probably owns a device that offers secure identity verification (laptop, phone). Yubikeys are great but they're super niche. Among Android users alone there might be a billion people who will never buy one.