Allow me to reiterate my argument against passwordless. The same people that shouldersurf a pin will still your yubikey.
This is why you need MFA at every authentication control. MFA means layered defense. Two factors are superior than one regardless of how good that one factor is. I support passwordless with MFA, in which case "passwordless" is just a marketing ruse because you still have to remember a secret similar to a password. And no, biometric auth "who you are" is the equivalent of a username not a secret you can use to authenticate (can be replicated but can't be revoked).
This is why you need MFA at every authentication control. MFA means layered defense. Two factors are superior than one regardless of how good that one factor is. I support passwordless with MFA, in which case "passwordless" is just a marketing ruse because you still have to remember a secret similar to a password. And no, biometric auth "who you are" is the equivalent of a username not a secret you can use to authenticate (can be replicated but can't be revoked).