[Ajedi32]

There's been a W3C standard that meets all those requirements for a couple years now: https://www.w3.org/TR/webauthn/

Only problem is there aren't any password managers that implement it, so it's not actually practical to use as a primary authentication factor yet.

[anderslemke]

WebAuthn is great! I don't see any reason why Promise shouldn't implement it.

I see it this way, that Promise makes it possible for all its relying parties leverage WebAuthn by implementing it once, so they don't have to.