It's presumably the authorized party who has the most to lose if the passkey backend is compromised, so it seems weird that the who-to-trust-for-auth decision f

It's presumably the authorized party who has the most to lose if the passkey backend is compromised, so it seems weird that the who-to-trust-for-auth decision falls to the web service. I'm reminded of a sign in front of my neighbor's driveway: "Ford parking only"