It looks fairly well thought out. I can imagine myself adopting it for internal sites (e.g., auth against corp okta)
Does anyone have any experience with it? It's been a while since I've really dove into authentication best practices, so I don't want to comment on implementation quality. The interface looks nice enough to use.