Passkeys are a good idea to prevent phishing. Using passkeys but then require a second method to login as a backup to prevent lockout when you lose your key (as many sites do) is epic bullshit. It makes an actual security improvement into some convenience feature so people don’t need to remember/type passwords anymore. Because the phishing will now ask for the alternative/recovery login to fix some alleged problem with your account/passkey…

So it suddenly does not provide additional security anymore above what a password manager would already do.

When you sell somehting as a security feature then instantly defeat the additional security to make it just about convenience the question about the actual goal feels natural…