> Generally, authenticators are “something you have.”

Shameless plug: Here's one that is "something you know" :) https://github.com/lxgr/brainchain

It derives all keypairs from a passphrase, and rederives the private key from the key handle, similar to "stateless" hardware authenticators.

Please don't use it for anything important – it's a fundamentally bad idea, similar to "brain wallets"; I only implemented it to figure out whether it was possible, and to improve my own understanding of the WebAuthN and FIDO specifications.