I think, none of the possible auth schemes without hardware security modules or multi-factor auth are prone to zero-day browser vulnerabilities. To compromise t

I think, none of the possible auth schemes without hardware security modules or multi-factor auth are prone to zero-day browser vulnerabilities. To compromise the PKI to actually reveal the key material, one must have pretty severe vulnerability - which is less likely to happen, if compared to typical cross-site cookie-stealing hacks. Uh, and many desktop PCs have TPM chip available already - if those aren't banned by your country's import rules (unfortunately, my country does so). Those could be well abused by evil corporations in treacherous computing schemes, but they also have good uses. Probably not safe against TLAs, but since those chips hold the keys and do the crypto by themselves, they're very unlikely to reveal keys even in case of browser exploits. Malicious sign requests can happen, but that's about it - to me it seems to be much better than with every other approach to auth. So, even if you don't have a fancy USB-pluggable HSM stick it's well possible you still already have fairly secure way to store key material.