Hi @dan. I'm quite new to this and not very tech savvy. While I think it's great that you're making account recovery easy I wonder if you could further consider the user experience. So far, making the system more secure has also made it more complicated for less techy people and I'm finding that people I know who have signed up don't ever want to even try logging in again. Here are some comments from friends that I had sign up.
I've written a post here which proposes a possible solution.
I wonder if you or Ned have considered it already.
My brothers post suggests that SteemIt.com needs to support the U2F protocol in order to allow users to secure their accounts with an actual physical key (like a USB) that the account holder uses to plug into the computer when logging in.