This is generally way easier for employers, since they can pick a FIDO2-enabled SSO platform, and then tie everything to that. So you don’t need each service to

This is generally way easier for employers, since they can pick a FIDO2-enabled SSO platform, and then tie everything to that. So you don’t need each service to have sane FIDO2 support, you just need them to support SAML/OIDC/etc. You also get mostly out of the key management business, because you can say “if you get locked out, call the help desk”, vs personal usage where backup keys / account recovery requires a per-service recovery flow.