By using the built in device attestation feature to blackball any passkey providers that allow that, apparently: https://github.com/keepassxreboot/keepassxc/is

By using the built in device attestation feature to blackball any passkey providers that allow that, apparently: https://github.com/keepassxreboot/keepassxc/issues/10407#issuecomment-1994299617 https://github.com/keepassxreboot/keepassxc/issues/10407#iss... Now imagine a whitelist of acceptable providers. Suddenly, you don't even own your credentials anymore.