Way-not-gonna-land as someone said some years ago. :-P
I'm using Wayland for my work now for two years now, and it has been amazing.
But then, I rarely do any graphics work.
You say 1 and 7 are project goals but I don't agree and I'll say why:
1. If you are not keeping your project alive and it is useful, then someone else will take your project and keep it more alive. and your influence will reduce. So, assuming that you are a good BDFL, you should make effort that your project is alive so that the BDFL at top is good.
2. The ability to fund people for the project is as much a story of actual resources as it is about the culture. If you do not try funding people right from the start, you will accumulate people are also not that interested in funding people. This means your project will remain a hobbyist project. And this actually impacts 1 because then your project might not be that sustainable.
A physical device which is not your computer stores some secret information which can authenticate you. This can be passwords, passkeys, GPG keys, your retina etc.
The physical device can be password protected. So you have two step authentication:
1. your physical device
2. your password to that device
Phones are currently being promoted for various reasons, but I believe something like Yubikeys or other FIDO2 fobs will be a better device. You can have multiple of them, you can store one of them in your bank safe. Someone stealing it of you is proper theft which can be traced in a usual manner by police. Stealing is not enough because you still need the password. The difficulty of asking you for password remains equal to difficulty of hitting you with a wrench. You don't need to remember stuff anymore, because you can just use your physical keys. You will need to travel with those keys, but its just same as your house keys. It is probably an extra key in your key fob.
To add to it, the U2F/FIDO2 standard will make it vendor independent, and so no lock-in.
The mental model is very simple. If you use things like Yubikey, it is exactly like a key you use to start your car. A single password protected key maybe. In essence, it is your password manager but something that everyone can use. And something that doesn't need to be on the cloud.