The parent of your post outlines a phishing attack vector. The only known way to close the vector is nuking the user account. If you can explain how, in a phi

The parent of your post outlines a phishing attack vector. The only known way to close the vector is nuking the user account. If you can explain how, in a phishing resistant way, passkeys can grant access to a user’s account in the absence of any devices they own, I’d like to hear it.