It’s worth noting that Yubikeys, the most prevalent WebAuthn device at the moment, do not support either biometrics or PINs for FIDO2 auth. So while yes, ideal

It’s worth noting that Yubikeys, the most prevalent WebAuthn device at the moment, do not support either biometrics or PINs for FIDO2 auth. So while yes, ideally you’d use a hardware-secured key, which unlocked that key using a biometric or PIN, that’s not the most common workflow. The exception is devices like the Google Pixel where it’s using a built-in hardware security device.