Doing 2FA correctly in isolated hardware is expensive. We traded adoption for an imperfect implementation.