Came for the Harry Potter reference, stayed for the content. Great article ! I use this approach when allocating secrets to users : the secret is a mix of a unique secret in database per user, and a environment secret shared by all users. This way if
one of the source is compromised my secrets remains safe.
The "2FA with my head" looks very interesting to me.
On a side note, the risk of using only one Horcrux is that if 2 of your passwords gets compromised, your Horcrux gets slayed by Basilik Venom (because that's an easy catch). Somehow Voldemort was ahead of us in muggles in terms of security with the powerful choice of 7 Horcrux.