I'm considering this too. I've had two accounts that locked me out and the risk is too high. I recently debugged a PHP + JS webauthn implementation and it's

I'm considering this too. I've had two accounts that locked me out and the risk is too high. I recently debugged a PHP + JS webauthn implementation and it's incredibly complex. It's not a protocol that can be consistently implemented across websites. I wish more of the protocol had been deferred to the browser