aarOS
Use a passkey for normal access. Google is the bootstrap and recovery path for the one allowlisted account.