If they actually worked like SSH keys that would solve some of the problems with them. (like keeping a backup that you can still enroll into new accounts without it being present).