@Xavier@infosec.exchange I would start voluntarily using passkeys when I feel like I have meaningful control and understanding over them. The fact that I can't disable passkey support and instead have to make sure that one isn't being created and stored somewhere means that now I don't trust login flows to not break my ability to use a website from another device. When my insurance company starts assuming that it can force a passkey on my account and that I want a specific device to be able to log in in the future makes me deeply suspicious of why they're suddenly so concerned about it. I've been burned by terrible, broken passkey implementations and combined with the lack of transparency and control, I'm just not interested.