I wished for the article to tell us how to set it up at least from a bi high level.

I also think SSH certificate authentication mostly solves the “key comes from anywhere” problem by automatically expiring certificates.

This isn’t as immune to this type of attack as Secure Enclave, but you do get a benefit where the user has to get the correct certificate periodically in order to maintain access.

If I pass my credentials and certificates to someone else or someone steals them, they’ll eventually expire.

The impracticalities of Secure Enclave are obvious to all of us: recent Apple devices only.