I don´t think I've ever come across a service that only used passkeys. Username/email + password + 2FA is usually the primary form of verification. There's usually a way to recover your account through email.

I use passkeys only, for the backend admin app for my app.

They work fairly well. I use a login ID/PW to set up the passkey, then the passkey, for everything else.

Passkeys work well, but I feel as if they are still a bit too “fiddly” for your average mensch.

I’m pretty sure the private key is transferable, but Apple keeps them in the Keychain, so they seem locked into the OS. On my machine, I can also keep passkeys in 1Password.

A while back, I wrote up a series on implementing passkeys in iOS/MacOS: https://littlegreenviper.com/series/passkeys/

Doesn't that defeat the purpose? I thought the objective was to get rid of passwords