we got browsers with built-in password managers, detecting password inputs and trying not to get autcompletion exfiltrated by xss and other shenanigans, basically users never interact with the password fields
so why on earth can’t we just use that same password management functionality for pubkey auth instead, like it had been proposed for html5
that would have been so easy to implement for existing websites it even has potential for widespread adoption. but for some reason that whole thing was just dropped and the only replacement is some overengineered hardware token 2fa nonsense that almost nobody will use voluntarily
