Ugh, I'm really going to need virtual phone numbers for all these "second factors" (i.e. linkable identifiers), I'm just not sure where to get them. Twilio requires a credit card, and most other businesses that offer this look super shady.

There's no requirement it be SMS. Card payments in Sweden are already able to comply with this just by having a phone app for authentication.

I won't install an app on my phone. It probably won't work without Evilcorp Play Framework, it probably won't work with root, and even if neither of those are an issue, I still don't trust my device enough (I won't install banking, password managing, or pgp apps on there, it's too much of a play thing for that). My trusted things are computer-based, not a mobile device that goes everywhere and that I want to be able to use without having to unlock the screen with a complicated password every time.

So it'll probably be SMS, and otherwise they can ship me a second factor -- as the Rabobank already does for as long as I know: they basically send you a payment terminal that creates 0 cent transactions on your card, if I understand it correctly. While a bit annoying, it is safe and not too inconvenient.

That's great news. I hope it will finally result in international support for more secure internet payment. I can do so domestically, but as soon as a transaction is international, credit cards is basically the only thing that's accepted.