Just yesterday I was showing to a friend how I logged in my self-hosted forge with my own hardware key.

0 intermediary yet proper and convenient authentication. If that friend ate the key (which he didn't) I'd just use my backup key, a cheaper non biometric one.

I think it's not more popular because people don't care enough about security to buy actual keys, rely instead of 3rd parties that they don't actually trust, e.g. Microsoft, Google, etc then... complain it's not good enough.