> But this went out of the window when some genius decided that usernames were too complicated, so Passkeys had to be discoverable, which means they have to be fully stored token-side. Which of course has the nice side benefit of essentially killing hardware tokens and forcing people into using their Android/iOS/Windows device for it.

This part of your comment is incorrect. Discoverable Webauthn absolutely can be used with hardware tokens like Yubikeys.