In order to be usable, many (most?) providers will implement some kind of override to allow recovery workflows. Have a look at https://media.fidoalliance.org/w

In order to be usable, many (most?) providers will implement some kind of override to allow recovery workflows. Have a look at https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases-March24.pdf https://media.fidoalliance.org/wp-content/uploads/2022/03/Ho... and multi-device passkeys. Your keys may never leave secure storage (tho again that is an implementation detail), but how sure are you about the sync implementation or the backend configuration that dictates which keys or methods are acceptable authenticators? As a trivial example, it seems very likely that providers will implement one or more forms of backdoor to ensure that LEOs can access your cloud resources.