You've missed that the ultimate problem is this assumption that there even exists one singular "best" way that should be implemented uniformly top-down. Some pe

You've missed that the ultimate problem is this assumption that there even exists one singular "best" way that should be implemented uniformly top-down. Some people will be happy using secure passwords and a local password manager. Others will be happy with no password but an email/SMS challenge. Some will prefer setting up a menagerie of security keys. Any many will prefer different mechanisms for different sites, depending on what a particular site means to them. Infantilizing people and trying to protect them in spite of themselves never works out, but rather just makes for a race to the bureaucratic bottom where everyone suffers death by a thousand paper cuts.