I like your idea of webidentity. Is it only theoretical, or is there any sample code?

I have been thinking about the particular issue migrating identity too.

My thoughts are mostly around additional keys. Realistically, you have more than one device. You could associate (some or all of) them with an account. This, to me, feels like it's more inline with key based auth.

My other thought was something like the list of codes you have with other 2FA solutions.

I don't think we will ever eliminate passwords in the sense that a person will never need a password ever again, but I think the solutions above definitely get us to the point where we literally never need to share a password.