Totally agree on the steps Apple & Google are taking, and a secure export/import should -I think- implement similar protections. By setting a PIN/fingerprint (

Totally agree on the steps Apple & Google are taking, and a secure export/import should -I think- implement similar protections. By setting a PIN/fingerprint (that should already be mandatory for passkeys), using usb or NFC for proximity, and of course pub key encryption à la HSM, I think more or less you should have all the ingredients. I personally like 1) to stay away from BLE, and 2) to stay away from using a server in the middle. On a phone, of course, you have more features but you also need to make the experience incredibly smooth even in edge cases (hence BLE, hence the server). While on the topic, I found this podcast episode very very interesting [1]. As for the storage I'm not particularly concerned, if people start to use passkeys, we'll allocate more storage in hardware devices. (and I'm also personally much happier with non-resident keys, however the market seems to be moving towards passkeys, so I guess we have to embrace it.) [1] https://securitycryptographywhatever.buzzsprout.com/1822302/11122508-passkeys-with-adam-langley https://securitycryptographywhatever.buzzsprout.com/1822302/...