Have you looked into Passkeys/Webauthn at all? It looks really promising but there aren't very clear and consistent ways to implement afaik