A note on attestation, since that's a part of Passkeys (and Webauthn) that's frequently misunderstood: WebAuthn has a broad understanding of "attestation," incl

A note on attestation, since that's a part of Passkeys (and Webauthn) that's frequently misunderstood: WebAuthn has a broad understanding of "attestation," including "self attestations"[1] and no attestations at all[2]. To the best of my knowledge, Passkeys do not impose any further constraints on attestations, meaning that compliant authenticators don't need to send any attestation at all. Relying parties can of course reject authenticators for any reason, including for not having an attestation statement (or not having one from a particular vendor). In practice, I'm not aware of any major public service that does that: actually verifying vendor attestations introduces yet another PKI, and has dubious security benefits outside of corporate (meaning fixed hardware) contexts. In other words: while understandable, I think a lot of concern about vendor lock-in and lock-out are pretty overblown. There's no indication that services like GitHub will even find attestation handling feasible, much less desirable. [1]: https://www.w3.org/TR/webauthn/#self-attestation https://www.w3.org/TR/webauthn/#self-attestation [2]: https://www.w3.org/TR/webauthn/#none https://www.w3.org/TR/webauthn/#none