That's self sovereign identity. But you still need someones that can issue those verifiable credentials, and we (as a global society) can't decide who that should be in the web of trust? Our banks? Governments? Schools? Doctors at time of birth?

Arguably, that's the only way forward. SSI is also nice because you get to fully control what you share and don't share (e.g., age verification, you get to only share "I am over 21" and no other information).

Passkeys were (are?) supposed to be just a password replacement though. That services are using them to replace a username AND a password AND 2FA is a problem that's turning the device into your identity, instead of keeping the identity as three parts (What you know, what you have, who you are (biometrics)). Now we've just turned the "something you have" into the entire identity stack.

Put yourself in the role of a consumer for a second.

As a consumer, I don't give a shit. I use my driver's license to apply to jobs, my passport to fly, and a password (with 2FA depending on how much I / my employer cares) for everything else. I prefer whatever I use for 2FA to not be device-bound, because that's obnoxious, error-prone and constraining.

As a consumer, I don't see any reason for my auth to be more complicated than that.

> we (as a global society) can't decide who that should be in the web of trust? Our banks? Governments? Schools? Doctors at time of birth?

Yes? I mean, that's what literally is there by default in every country. They're not either/or either, they're part of a chain.

Most importantly, none of that is device-bound. Or even person-bound. Which allows for delegation, which is a feature that cybersecurity people keep insisting is not real.