That makes sense. The way my thoughts have been going from reading about this and passwordless authentication is that it's a lot more important WHO you trust than HOW you trust.

If both the user and the service independently trust the security agent, then each of them only needs to trust one actor.

It does imply an important discussion regarding how many eggs should go in one basket.