You
can
think of keys as being a device key.
But now you just kick the can back. You still have to have an account that manages the device keys, and you certainly don't want that locked down to a device - unless that device is the user's brain.
So either way, you're still gonna have to use a system to manage it that looks 110% like the MIT Open Source security/cryptography code anybody can rip from us.