The conflict between single point of authentication and single point of failure is intractable. Just pick a poison based on which is less likely to fuck you over.