This seems like a consolidation of risk to rely on a password manager, especially software defined, especially if it relies on a password. I like the hardware token idea (yubikey). But even that seems cumbersome because you should be making a copy for safe keeping. And how do you securely do password recovery if most security questions can be obtained via osint or the reset links are sent to a site you are similarly locked out of is compromised?