Those were my main concerns with the whole thing. At the moment, through, passwords are good enough for most people who aren't specifically interesting targets

Those were my main concerns with the whole thing. At the moment, through, passwords are good enough for most people who aren't specifically interesting targets, so I'm not super concerned or holding my breath. I just don't see people who use password managers and any kind of 2FA, even SMS, getting hacked in real life. I expect the main value of passkeys will just be that people will be forced to transition from memorizing to letting the computer manage credentials.