I think the core problem is they’re called passkeys and evangelized as a replacement for passwords, which makes people think they’re like passwords or like keys—secrets we’re responsible for not losing—whereas actually they’re like session cookies. They’re a fast path in that you’re meant to be able to create, delete, and even clear all of at will, with no penalty but that you’ll have a fussier login next time. They sure do suck as an only way in, they’re not even meant to be able to do that.