that's just a strawman bad account creation flow that has nothing to do with passkeys. you verify the email address first.

passkeys use a unique keypair per account, there's no single public key that represents you.

Indeed, I was illustrating that DecoPerson was proposing that passkeys solve an account creation flow problem. They do not.

But as DecoPerson points out, in the realm of account creation, your "verify the email address first" solution has its limits.

It is easy to conflate different aspects of trust and think they have the same solution.