@jonny this thread made me chuckle. Need to hand you a spade for the hole you were digging… BUT I happen to agree. The ONLY real value in passkeys is usability for the average person where it increases security over traditional unp/mfa. Unpopular opinion but I believe the added complexity makes it less secure than say, a FIDO key. I can’t prove this, but as an architect it feels more complex than it needs to be… which is usually when I’m correct. While attestation might be useful in a corporate sense I think there’s real danger in the big tech cartel forcing device attestation as another data point to farm, and locking in further with age verification and aiming to remove all anonymity. But beyond that… big tech and US government/law enforcement involvement is every kind of bad.