[toomuchtodo]

Supporting passkeys and hardware keys for MFA should be mandated by statute. I know, heavy handed, but witness the current auth/identity challenges making the need clear.