But also, right now giving a website a passkey basically means being technically savvy or using a sensible system like the browser/OS. TOTP used to be this way, but then people got annoyed at the process and put everything into 3rd party apps that synced across devices. The same will happen with passkeys, at which point "passkeys are a website..." will morph into "attested passkeys are a website..." and the rest will remain true.
But also, right now giving a website a passkey basically means being technically savvy or using a sensible system like the browser/OS. TOTP used to be this way, but then people got annoyed at the process and put everything into 3rd party apps that synced across devices. The same will happen with passkeys, at which point "passkeys are a website..." will morph into "attested passkeys are a website..." and the rest will remain true.