I've been using certificate based auth on https for ages on my ops stuff. Most devices support just slapping an SSL/TLS key into their os, but not everything.

But when I wanted to use it for Jellyfin, I found TVs and sticks aren't all straightforward.

In your link, they closed that ticket as not planned because they intend to implement FIDO's secure exchange protocols. https://github.com/keepassxreboot/keepassxc/issues/11363

It should (hopefully) be secure when they get done.

i refuse to give my phone my thumbprint or do a face unlock. i'm not sure if it's still collecting a biometric bullshit on my face, but i have not done it myself.

Then get a Yubikey. Replace “something you are” with “something you have”. It’s not ideal to have two somethings you have as your two factors, but a password to get into the computer to get to the passkey adds an extra layer that makes me comfortable with it.

I'm a luddite here and i insist on it so no one (especially no one trying to violate the united states 4th amendment) can get into my phone without my permission or hacking into it.

In the context of this discussion, it’s one of two factors. But I agree with you when it’s the only factor.