> supposed to be device-bound

Device bound is horribly broken idea. Credentials must be me-bound, so I and only me fully own and control the credential. I want to access the site from wherever I want to access it.