Comment by pllbnk

I agree and I have a good example.

At my work we are forced to use passkeys internally and it's fine with me.

At some point in the past, due to the constant nagging I set up a passkey on my GitHub account.

I needed to sign in to work's GitHub account, so unknowingly (since there's no SSO option there) I just clicked on "Sign in with a pass key". It didn't ask for my username, just gave me an option to scan QR code. And I did because work's pass key is set up on my personal phone. Then I noticed that it's trying to sign in with my personal GitHub account. It's good that I don't have anything sensitive on there but I really wouldn't want to sign in on my personal account on my work's laptop.