I.e.: WebAuthn authenticatorAttachment: "platform" Using email OTP as "reset/new device" mechanism and fallback in case the platform doesn't support WebAuthn.

I.e.: WebAuthn authenticatorAttachment: "platform" Using email OTP as "reset/new device" mechanism and fallback in case the platform doesn't support WebAuthn. Platform authentication means it uses TouchId/FaceId/etc. which people are already somewhat familiar with. And email OTP as password reset is something people are used to. (They are also often used to resetting passwords all the time on rarely used accounts.) The question is just how many of your users are on devices which support it. (And how hard it is to implement it with the tooling you use.)