Users can’t manage them and nobody has come up with software that can.
I have worked with PhDs who can’t even manage ssh keys.
I have worked with PhDs who can’t even manage ssh keys.
Not a good point.
I've experienced PhDs who can't (even, some may add) write shell script. Maybe they just hate the syntax, or specifically the $ symbol, maybe both. But, they did do fine job otherwise and has successfully replaced me, a person who can write a bit shell script :(
Even 2FA solutions like Google Authenticator are simple enough that you just need to scan a QR code but very few people use them and even fewer actually bother to print/save the backup emergency codes for use if they lose access to their auth device.
People can (sometimes) handle passwords, and an emailed reset link if they forget.