I continue to think that /the/ critical problem with web3 as pitched is that users cannot be trusted to maintain private keys in the long run. Either the keys need to be in HSMs and easy to rotate (à la Urbit's identity-as-NFT scheme) or you need a social/institutional escape hatch when the cold logic of cryptography fails you so you're not completely hosed. Maybe you need both.