But they must allow some kind of proxy signing so that you can sign in from other devices besides the phone. So how do you protect against misuse of that featur

But they must allow some kind of proxy signing so that you can sign in from other devices besides the phone. So how do you protect against misuse of that feature without logging any identifiers?