One of the reasons this is so important is that it makes it far harder to phish people. The webauthn APIs include the web origin in the authentication process,

One of the reasons this is so important is that it makes it far harder to phish people. The webauthn APIs include the web origin in the authentication process, so it’s not possible to use something like modlishka to phish people. If we use magic links or something similar like a QR code for adding new devices, or more users also have roaming authenticators with PINs, webauthn will massively massively reduce phishing success where it’s implemented, as it’s pretty easy to make website that doesn’t have phishable credentials at all.