If this is true there really is such low hope for cryptocurrency. If you can’t store your keys in a service like LP hardened via physical 2FAA. What’s left? Air gapped setups?
The more numerous the places where we can abandon passwords, the fewer the secrets that we need to keep.
Ultimately, I expect the biggest barrier to be mental. People have had mantra about passwords banged into their heads for decades that they have become synonymous with a secure system and people are suspicious when their device just lets them in with little to no friction.
I just set up a whole backup solution for my many self hosted applications, all encrypted with the keys safely in my password manager. Even uploaded to S3, because I figured if I'm paying for it, I could ID-and-support ticket my way to my data even if I lost my AWS credentials.
I don't know how to integrate a security key into this scheme. What to do if it actually gets lost ?
Will I have to use emergency codes for all the accounts ?
Can I make a backup of it somewhere ?
Would that defeat the purpose ?
I'll buy one someday, when I'll have all this figured out.
It is a little bit of a hassle. But changing 200 passwords because LastPass was breached is also a hassle.