fair point, so I built it: email+password login is live now, with TOTP 2FA in settings. passwords are checked against known breach dumps too.