Still needs an arguably perhaps overengineered complicated standard to do it, and seems to open the door to more hardware attestation demands. I’m not a fan and I refuse to use passkeys. (But I can see the use for preventing fishing attacks, so I realize there is no obvious perfect answer here.)