Metamask relies on whatever RPC you give it, including your own node if you want

The asym crypto is enough for proper authentication, but decentralized apps generally are built to use it, without relying on centralized data. A message signature being verified by a stateless service is all that is required

Could do without web3, but the practice of predatory web giants and smaller startups is to exploit the users so they don't do that