I’ve compiled the entire sordid history of TreasuryDirect authentication in their Wikipedia article: https://en.wikipedia.org/wiki/TreasuryDirect