The way things like this are developed is not by "clever and highly paid engineers". They're developed by a cabal of businesses led by a standards body to try a

The way things like this are developed is not by "clever and highly paid engineers". They're developed by a cabal of businesses led by a standards body to try and wrangle all the competing interests into one solution for everyone's problems (lol jk, it's to solve the problems of the most influential organizations involved). Because the whole process is design-by-committee on crack, the solutions don't tend to be technically very good. But they don't need to be, because they're not trying to solve a technical problem, they're trying to solve a business problem. The solutions they come up with are always ugly and broken at first, and don't account for all the needs of everyone (remember, only the most important's needs get met first), so they eventually churn out a fixed version and that becomes the version everyone ends up using long term. WebAuthn/Passkeys/FIDO/etc aren't even one solution or standard. They're a cobbled together patchwork of different pre-existing standards with some extra pixie dust mixed in. Almost everyone agrees that the users and implementers are who loses out when these things are pushed. But a couple giant businesses have an easier time solving their problems, which are large-scale security problems. And all the rest of us use it, because we tend to defer to large powerful authority figures, and we don't know what the hell else to do. Whatever universal solution is pushed will continue to suck balls, because there are too many different use cases, and no single solution will ever work well for all of them. What has worked, is working, and will continue to work, is to simply support a variety of different security mechanisms independently, and allow users to install a password manager which wrangles it all for them, across different use cases, sites, applications, devices, organizations, etc.