> and it's impossible, by design, in a public-key-crypto-based system.

I think anyone believing otherwise should spend a few months as front-line tech support dealing with forgotten passwords and then (perhaps) reconsider.