The signature VC approach you proposed is essentially how we manage on-device passkeys for LifeCare.ID, recovery is via email at moment. Key recovery and identity verification moves to the trusted provider in production.