We are "very early" in the sense that we're in the same place as 1996: usernames, passwords, credit card numbers, and SSL. (Or maybe we're worse off, since we didn't have much phishing in 1996.) What is it going to take to get some progress here?

It's not the government's job to pick winners and losers. Think about the words you selected: bully and progress. Together those don't sound very democratic to me. It's ends justifying the means thinking that gets well-intentioned people into trouble. Progress is people wising up about security, not forcing them to use certain technologies.