I can feel comfortable with passkeys as an alternative (maybe even default) login method. But given the changes for attestation and what this enables, along wit

I can feel comfortable with passkeys as an alternative (maybe even default) login method. But given the changes for attestation and what this enables, along with hostility towards portability from the spec authors, it means that I cannot ensure I have access to my passkeys going forward, so being the only auth method is problematic. That is often the current state, which is good, but the security goals of passkeys are then limited if passwords still exist, so I'm not confident that that will remain more than a transitional state.