Or, we can develop solutions based on existing [proven] cryptographic primitives, with a focus of abstracting authentication / signing / encipherment functionality to an external key or secure-device.

Example: iPhone (and Andorid) both have "secure enclaves" where cryptographic keys are stored. However when you step into the basic PC/Linux realm the concept of a secure-device for key storage (TPM) is pretty non-existent outside of corporate players. We can do better, without totally going pie in the sky.