May I introduce you to the german “Elster” tax portal? Most fucking insane security mechanisms ever. They support fido2 but with their app, not via a browser. They have a probably encrypted keyfile but that expires in 3 years and you need to login switch to desktop mode as otherwise they hide it send a code per email the site generated another code you also need you get another email with another link, which also doesnt include any code you need to logout to login again? you need to enter the 2 different codes for whatever reason. One is generated on the site before you need to log out then wait forever to create the keyfile you also need a password So afaik you need a username, email, password, keyfile and password for the keyfile. why a keyfile again? why a username if it is never used? why so many emails with all the secret credentials instead of secure e2ee login on the website? Most insane shit I have ever seen, this should be illegal