Passphrases only work in locales with 5a or similar protection, and either have to be managed by a single person or have the potential to be leaked.
Great for small businesses, but unworkable at the enterprise level.
But having a canary mechanism for smaller businesses is crucial, because they can’t afford to put a wall of lawyers between them and potential government overreach.