Sure, I think your logic makes sense, and I don’t want to overemphasize complaints about headlines.

Regarding how I feel about passkeys after reading your article, logically I am reading what you wrote and conceptually understand the trap, it’s just hard to wrap my head around what kind of situation would cause this trap to “catch” me so to speak.

I.e., the upside is real and immediate, the downside is theoretical and tied to future uncertainty.

You're right, I didn't explain in much detail the motivation that will push websites to start requiring the remote attestation flag to be set. I will try to cover that in a future article.

But as for how it could "catch" you: if you use FOSS devices that are unattestable (as is the case for the LineageOS phone and Linux laptop I exclusively use), you may one day find you can't use many websites.