> whereas password auth can be done in several lines. Secure password auth is complex and because of externally imposed constraints like phishing, generally ne

> whereas password auth can be done in several lines. Secure password auth is complex and because of externally imposed constraints like phishing, generally needs more work to support. You also need recovery flows, etc, since just losing access typically isn't acceptable. So I don't think password auth can really be "done in several lines." Realistically, I think the takeaway is that no matter what you're talking about, storing private material on behalf of someone sucks complete ass, and is not easy to accomplish on a modern computer in a secure manner, no matter how you slice it. But we still have to do it. Luckily Passkeys do have actual tangible benefits beyond passwords (e.g. unphishable, no private key material stored by the server), so getting this right does come with actual benefits beyond the status quo.