Comment by Simulacra

Passkeys are really an abdication of cyber security responsibility by the vendor. Offload everything onto the consumer, and you have plausible deniability for anything that happens.