PASSKEYS ARE NOT A TRAP

Summary from the TLDR Dev newsletter

Synced consumer passkeys generally return no attestation, and WebAuthn attestation identifies an authenticator model rather than a user's operating system, browser, or firmware. The response argues that passkeys remain more phishing-resistant than TOTP and recommends continuing to use them.