Metamask can sign data, which would help you prove the user has the private for a given public key. You do not need the blockchain.

The chrome extension to cryptography would help - but we have FIDO that does exactly that (and webauthn i guess).

Indeed that is possible, the problem is all the greedy corporations that want to suck all our data, so they can't simply trust the signed messages of Metamask and want instead to implement layers of poor software for their profit

oh i mean, identity/authentication alone doesn't make profit right?

The problem with using PK cryptography is that if you lose your keys, you'd be locked out.

Then we would probably have other key schemes M-of-N etc or social proof to compensate for the problems with single-key PK, which then has other problems.

Metamask relies on whatever RPC you give it, including your own node if you want

The asym crypto is enough for proper authentication, but decentralized apps generally are built to use it, without relying on centralized data. A message signature being verified by a stateless service is all that is required

Could do without web3, but the practice of predatory web giants and smaller startups is to exploit the users so they don't do that