Stupid question: I've been waiting for over 25y for websites to start supporting (something much like) ssh public-private key logins.
Why isn't that happening?
Yeah, there's all kinds of Facebook/Google login crap that's possibly even worse.
Most of us have several passwords in public databases because web admins are apparently so incredibly stupid as to store passwords in plaintext.