While I'm glad to see this be dome with the W3C (that way it can actually be standardized and used by more than just two platforms), I find it kind of odd that

While I'm glad to see this be dome with the W3C (that way it can actually be standardized and used by more than just two platforms), I find it kind of odd that something like the Secure Remote Password protocol (SRP) hasn't seen much use. Or at least I haven't seen it, correct me if I'm wrong. That way the password is never known to the server and we also don't have to rely on hardware keys. Personally I don't know anyone using hardware keys, they're just annoying to use...