fair, the comparison has to be against what people actually use. for now, i think we should promote passkeys for local signing and recovery to me, that looks like a better balance between security and ease of use, though the details of how we store and recover the key matter