Yeah, that could be neat as long as they still add a recovery key to the AD or somewhere else. A problem with that is that the users will likely choose shit passwords. That could be mitigated with password rules but still

I suspect Microsoft wants you to use TMP or physical keys instead of passwords.