Mutli-sig wallets are but one non-custodial solution.
Not long ago, Signal demonstrated a way to recover passphrases in a way that server compromise doesn't really reveal anything at all about the passphrase itself: https://signal.org/blog/secure-value-recovery/ The OPAQUE standard also has similar properties to Signal's design but much more cheaper to implement: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-opaque... I point these out because Novi (Facebook's Diem wallet) implements the latter. These never require keys to ever leave a client device (which inturn could be a hardware wallet).
Useable security will take time. It was a long road from GnuPG to Keybase/Signal. Given the amount of cryptographers and engs building for "web3", I'm sure something useable will crop up. May be it is Moxie himself who comes up with it, who knows? ;)
I'll believe that multi-sig wallets solve this when I hear frequent stories about regular human beings (not highly sophisticated tech insiders) who both understand them and use them successfully.