If this is your only blocker you could still use passkeys with a different provider, like KeepassXC?

Not while the spec has provisions to allow sites to mandate certain providers.