Comment by bdougherty

My understanding is that the passkey branding is specifically for copyable, user-verified keys. So the second factor is the biometrics (or equivalent) of your device. But yeah there doesn’t seem to be consensus yet about still requiring TOTP with passkeys.