I think the eventual right answer is to make it possible to do device management and sign-in in a federated way instead of piling all eggs into so few baskets. Right now normal Mac and Windows installs have similar problems in that it's getting hard to use them without ceding control to Apple or Microsoft.