As much as I hate to admit it (because I love passkeys UX), but I do think that device-bound/attested passkeys are going to happen in the future :(

UPD: oh, heck, attested passkeys are actually already in the protocol. Why can't we just have nice things?