> They're a standard. You can implement it yourself You can make your DIY authenticator, but websites might choose not to trust your self-signed attestation as

> They're a standard. You can implement it yourself You can make your DIY authenticator, but websites might choose not to trust your self-signed attestation as it is not "secure". Also, as I understand, passkeys stored on an Android phone can be stolen by an attacker with root access or by Google if you use biometric lock or PIN or lock pattern.