Passkeys already solve for this, we just have to get past the FUD.
In this case, how is the Passkey safer than 2FA?
It’s cryptographically bound to the domain.