System based on, e.g.:
PBKDF2, ECDSA and authenticator's random challenges.
Key derived from a password would be ECDSA's private key used to sign random challenges.
Is password brute force the only thing I should worry about or is there another threat involved with using such key as a ECDSA seed?