That is the purpose of 2 factor. 2 factor + password matches those same goals. I am not worried about transmitting my password on a device I own to a website I

That is the purpose of 2 factor. 2 factor + password matches those same goals. I am not worried about transmitting my password on a device I own to a website I trust. If I am infected with malware, my 2 factor and separate login recovery email will keep me safe. I understand the theory of using SSH like public private keys to move one step away from passwords, but the reality is if I don't have control over the private keys, they are not my keys. Not having control over my private keys outweighs any benefits I would get from using WebAuthn.