Comment by cesarb

> If you lose it report to the same people (service desk).

THIS is the reason it worked great for your use case. You have a stopgap for the worst case.

You also have a limited, well-known, and mandated set of compatible software and hardware. And you don't have to worry about attestation preventing you from using any future hardware or software, because you have control over any attestation whitelists.

The scenario people worry about is not "passkeys being mandated by your company to access company webapps on company-provided devices, with easy access to in-person passkey resets". The scenario people worry about is passkeys making them lose access to third-party sites on their own devices.