Comment by ajross

Right. For clarity: the choices are "use a third party authentication mechanism (like passkeys)" or "roll your own". And among vendors that continue to roll their own authentication, even the largest and most capable (like Amazon) don't try to do crypto like the upthread commenter was suggesting. It's just not practical unless you control the hardware platform. Passwords and telephone-2FA remain the rule.