I think what is needed is a chain of ID verification systems.
At one end would be a service where you verify you identity when signing up to the service by showing up physically and showing them your government issued photo ID. They photograph you and fingerprint you and take your signature and add all that to their records.
Let's call this service a root identity service. Banks would be great candidates for providing root identity services.
You can use this service to create a verified identity with other services. You would generally only do this with the most important other services, such as your email provider and/or if you have your own domain your domain registrar.
The way you would do this is when signing up with your domain registrar, say, you tell them that you want to verify your identity with your root identity provider. There would be a standard protocol for the registrar to query your root identity provider and for you to tell the identity provider that you are indeed trying to prove yourself to the registrar.
Once that is done, the registrar can set up your account as normal with a username and password and whatever 2FA methods they support. But since you have verified your identity with your root provider, the domain registrar would let you set an option to require re-verification with the same root provider if you need to recover your account after forgetting your password or losing your 2FA device, and to prohibit ever changing the root identity associated with the account.
Someone might steal your domain registrar account somehow, but you can always prove you are the owner and get it back as long as you have not lost control of your root identity account. If someone manages to get control of that, you can get that back first by going in person to an office of the root provider with your government ID, and having them in person verify that, and that you match the other ID information they have on file.
Now you can make Google accounts and Facebook accounts and similar. Those accounts you just associate with an email address. If one of those accounts gets compromised, you recover by going through the usual common recovery method that involves proving you control the email address associated with the account.
You can then use things like "sign in with Google" or "sign in with Facebook" for other accounts, confident that if someone hijacks your Facebook or Google account, you will be able to recover that, and so recover the accounts you use Facebook or Google to sign in to.
(You still have to worry about Facebook or Google themselves kicking you off of course, but that's not a problem of identity verification so is beyond the scope of this comment).
The idea is you build a chain of identity, with different links in the chain making different choices in the trade off between security and convenience. You decide where you want each thing to be in that chain, but as long each identity chain leads back to a root identity provider you can rebuild the links and recover any lost or stolen accounts.