> Naively I’d expect there to be a two-key solution that would allow Vendor A to transfer passkeys to Vendor B without requiring them to be stored unencrypted.

> Naively I’d expect there to be a two-key solution that would allow Vendor A to transfer passkeys to Vendor B without requiring them to be stored unencrypted. That's actually the kind of implementation I expect them to produce. > Is the issue just that the two vendors have to trust each other (as opposed to just both being trusted by the user) for that to work? I think the issue is that neither of the vendors trust the user. They'll probably devise an exclusive (i.e., monopolistic) list of trusted vendors.