Passkeys only make sense if multiple passkeys are supported. What if I lose my Fido key? One issue here is that passkeys don’t have a clear role. If they are replacing passwords, only, then they are 100% an improvement even when not hardware backed, but you still need 2fa. If they are hardware backed, you probably don’t need a second factor and different sites see different roles. Assuming I can setup a backup key, hardware backed covers all of sites’ misconceptions, though.

A few examples here to illustrate... The way ebay and Amazon handle this are great. Multiple passkeys allow login of multiple device ecosystems and/or hardware tokens so that users can mange their own level of risk and really any level of implementation is helps the average person.

Meta's implementation by contrast is bad, in my opinion. You are only allowed one passkey (so one login ecosystem/hardware key allowed) and it completely bypasses 2fa and security tokens. So, someone looking for more security must avoid passkeys "altogeher" and use password + U2f security key and the passkey only being allowed in a single ecosystem means that password/phishing lanes must remain open. All you're doing is disabling 2fa on a key that is likely sync'd to all of your devices. All that said...it may still be a security improvement for most users in the real world in practice, I just find it a very annoying and confusing set of security decisions.

The primary reason 2FA exists is because passwords are phishable. If you remove passwords, the need for 2FA largely disappears.