Comment by stavros

> Very much this. Having authentication tied to hardware you don't control is a near-certain denial of service in the future.

Then you can tie it to hardware you do control, or to software.

Obligatory "Passkeys misconceptions" article: https://www.stavros.io/posts/clearing-up-some-passkeys-misco...