Identity Bridging will eventually get 60-80% of users functionally off of our fallback and onto their provider's native authentication paths, but I do wonder if the Persona fallback support two-factor auth natively for the remaining 20-40% of users.
Persona leaves authentication entirely up to the identity provider. In the case of the fallback identify provider that you're probably seeing, they choose passwords. Other identify providers can choose any method of authentication that they want to use.
I think that he means that it is tricky. He doesn't hide this fact, but it is a know fact, and programmers should be award of it and its possible solutions.
I really hope that ChromeOS's way would be better.