When it comes to security, having to paper over buggy, not well realized implementations is just asking for disaster. You want your security code to look and a

When it comes to security, having to paper over buggy, not well realized implementations is just asking for disaster. You want your security code to look and act and BE boring. Nothing about Passkey's fits that definition at the implementation or code level. The idea IS awesome, the implementation is terrible. Not because they were awful developers that implemented it, but because it got rushed to production before it was ready. If they continue to iterate and fix the issues and make the implementation boring, close off all the edge cases, etc. Then it will be amazing and I'll praise passkeys. Until then, I'm afraid it's a new x.509/client TLS cert in the browser disaster waiting to happen.