The rapid change in standards coupled with confusing/changing naming got me to the point where I have no clue what the currently best approach for "passwordless

The rapid change in standards coupled with confusing/changing naming got me to the point where I have no clue what the currently best approach for "passwordless and/or actually secure 2FA" is. I also got locked out of an account (not Github) that I now can't recover without providing photo ID and god knows what other data, because something about their implementation changed and now my security key is no longer accepted. Most of the few sites that accept security keys also only let you register one, which means you can't have a backup. As I understand Passkeys "solve" this by effectively being backed up to your Google or Apple account, so once that's compromised, you've lost. As long as you're using a password manager (which will not autofill on phishing sites), passwords still seem like the way to go, unfortunately...