> WebAuthn lets a site work with Security Keys and that makes such a loss basically harmless unlike for password hashes.

Yes, because all of those teenage fanfiction readers are going to have yubikeys.

It’s built into most smartphones now isn’t it?

The same tech does Passkeys too. I suspect in the future we will move to passkey/yubikey only auth and store as little user data as possible.

And there will be a word you can type into a backup yubikey to make it an identical clone. I.e. a password.