Your understanding is correct and I agree with you. The Passkey spec authors, however, think services should be allowed to ban your client for behaving this way:

> [When UV is required, KeePassXC must request user verification or not handle the request]

> This implementation is not spec compliant and has the potential to be blocked by relying parties.

https://github.com/keepassxreboot/keepassxc/issues/10406

▲

Telaneo 2 days ago | parent [-]

> > This implementation is not spec compliant and has the potential to be blocked by relying parties.

The only conclusion I can come to when it comes to this and the earlier kerfuffle regarding being able to export the plain text of passkeys is 'the spec is bad and you should feel bad'.

	▲	coldpie 2 days ago \| parent [-]
		Yeah, it sucks. It could've been a cool technology but they're so locked in to "my way or nothing" and won't consider other usecases or security trade-offs other than the ones they decided on. It's just a complete non-starter with that attitude.