They support Passkeys. This is exactly how I continue using them after moving away from Google Workspaces.

Oh wow, I had totally missed this[0]! Is it possible to migrate an existing SSO account (with associated tailnet) to a passkey one?

[0]: https://tailscale.com/blog/passkeys