Also if you enforce the use of Yubikey or a similar DRM protected device then we're back to the user not actually being able to own/control their key. And if yo

Also if you enforce the use of Yubikey or a similar DRM protected device then we're back to the user not actually being able to own/control their key. And if you don't it's a second password which can be shared out. "Just use existing OTP" is a model that assumes that people actually want to protect their credentials. This is a Netflix password sharing situation and OTP didn't solve it.