If a provider wants to be in the identity business, I don't understand why it has to be tied to a piece of hardware.

Security and attribution is great, but the default assumption of everyone will sign up and do what we want doesn't work.