I had a similar idea, for an "auth box" that would could be hosted by a third party or ran at home on the end of a consumer connection.

Whenver you log in or sign up to a site, a request is made to this device which can authenticate the user and return the result to the site.

A big drawback to this scheme is that stealing the box could become profitable. It would also require a more mature network than we have now.

Passwords are crap and key management is hard, who really wants to do 2 factor auth every time they want to log into gmail?.