That is perhaps what all of these replacement schemes fail to realize.
I really wish "Login with PGP" was a thing and use a subkey for each website, with optional ability to hide the identity of a particular website in my own keychain. You know, sorta like passkeys, but I don't have to have Google/Apple/etc involved and I can actually inspect the magic behind the scenes.
Strong words, but why?
PGP doesn't do this: PGP key has a claimant identity, but actually verifying that claimant is left to the end user. That's why the WoT and strong set were important (before they violently collapsed, revealing that they weren't load bearing after all).
Other schemes do realize this, and it's why they make tradeoffs around trusted parties (CAs in the Web PKI performing domain validation, EV for code-signing, etc.).
I hadn't heard they violently collapsed; do you have any links where I can learn more about this?
https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d695...
Also, as someone who went to a few signing parties: the strong set was probably never as strong as some people thought.
How well would such sites handle PGP subkey revocation? What about PGP key revocation?
Revocation is very important if your key is compromised.
I haven't seen any really maintained pgp keyserver or service in general that didn't directly or indirectly (by user/agent mistake) fail spectacularly since https://evil32.com/ was released and contaminated the 32bit key id space.