Comment by petterroea

The main thing I think technical people forget is that just because a protocol calls for transferability being a required feature (not that it really is here), it really doesn't matter if implementing it isn't strictly necessary for the protocol to work. That's one of the reasons why we have a bajillion different OAuth and OIDC implementations that plug into existing account systems in various ways, from being the only way to log in to being an optional way of logging in to an account that can also have an e-mail and password set. Developers are busy, and often implement just what they need to plug in to the OIDC providers their PM wants, and nothing more.

Both Passkeys and OIDC are vendor lockin enablers due to these design choices.

I wish the next standards would keep this in mind.