This is not a bad question, but it is one that keeps getting asked on this topic. I really think standards like WebAuthn should more explicitly provide an appen

This is not a bad question, but it is one that keeps getting asked on this topic. I really think standards like WebAuthn should more explicitly provide an appendix about account recovery, even if that is out of scope of the technical standard. As others have pointed out, account recovery should always be provided in some form. A common way seems to be the use of a one-time password that can be used to regain access. What I'd really like is a clear best practice for this for developers to implement though. It doesn't help if your authentication method is strong when the recovery option has glaring security holes in it. It now looks like every site that uses WebAuthn just rolls its own recovery solution.