See, this is where digital identification schemes come into their own. 4-digit PINs attached to identity, not necessarily to specific devices, easily fixable if devices are lost, central registry with encrypted algorithms guaranteeing protection. No more stupid password settings, or OTP recoveries......
All that's needed for initial registration is a photo ID with a unique signifier - a passport would do it, as would a driving licence, or a national ID card.
As long as it's set up properly at the start, by the state, it's far, far, far more trustworthy and effective a method of verification online and makes logging into systems and even validating transactions and digital signatures a lot simpler.