Troy specifically addresses WebAuthn in that post but only as a 2fa mechanism (which is an optional way to use it). He doesn't address it as a standard to repla

Troy specifically addresses WebAuthn in that post but only as a 2fa mechanism (which is an optional way to use it). He doesn't address it as a standard to replace passwords. His premise of the post is that passwordless mechanisms are non-standard and difficult to use. WebAuthn can be used easily and implemented by anyone as it is now an open standard. Trpy's article is great, as always, and I'm not invalidating anything he said. But this particular post of his is intentionally a more short-term look at proprietary solutions, not a longer term view of evolving standards.