Please, no. Passkeys have reinvented an escape room from first principles. Bringing public-key authentication to the masses is a great idea, but the real world is much messier. Cross-platform credential management, password managers, browser inconsistencies, account recovery and domain migrations all introduce edge cases. For a major application like the one you’re reading this on, these edge cases affect millions of users. As we rewrote auth, I personally fixed 10+ of these last year (much to @nikitabier’s delight), and we ultimately introduced email/phone codes as complementary authentication methods. Even in tightly integrated environments, things break. Try logging into a machine that doesn’t have your passkey. Your browser asks you to scan a QR code, which requires Bluetooth, but your phone’s Bluetooth isn’t working. Unless you give users enough fallbacks, the final step in the authentication flow is apparently prayer.