Passkeys are a pretty terrible UX on their own, in that you have no control over managing them . And every site has a custom experience.

Epic for example has at least 3 different ways to load the pass key e.g. username first, passkey first, username + password, then passkey. Luckily their app lets you in with Passkeys alone

Walmart prompts for username first, then passkey, then it sends you a verification code to your email address.

The issue is that every site has a random flow of username, password, oauth (then a few oauth screens), passkey, 2fa and so on.

Authentication has become absurd. None of this is making people safer. If sites are seeing less fraud reports, it's likely they are harder to detect rather than less frequent.