100% sure we should make the trade off clear, or they could use delegated keys or connect a web2 Auth with the account, but we cant save everyone, some people will have to learn the hard way