Maybe once we replace passwords with FIDO2 more widely and people no longer have to remember and enter their password every time they manually authenticate, we

Maybe once we replace passwords with FIDO2 more widely and people no longer have to remember and enter their password every time they manually authenticate, we can shorten up session timeouts. Or, as GitHub does, we can require explicit authentication for sensitive actions. But yes, agreed—there’s not much FIDO2 can do to help when authentication isn’t required.