Android passkeys return `fmt:none` as well if you ask for an attestation certificate. Its pretty weird to claim that this is a big lock-in risk when both of th

Android passkeys return `fmt:none` as well if you ask for an attestation certificate. Its pretty weird to claim that this is a big lock-in risk when both of the major players are not supporting attestation certificates for consumer use cases. And the one well known site (vanguard) that was requiring an attestation certificate no longer does.