Forgive me if I sound dense but you would still want a password to unlock the private key, right? Otherwise, authentication is just "something you have" not "so

Forgive me if I sound dense but you would still want a password to unlock the private key, right? Otherwise, authentication is just "something you have" not "something you know + something you have." In which case, this headline might really mean "The beginning of the end of the password on the web".