Giving websites control over (or even knowledge of) which client the user is using is a very bad part of the spec. There has already been threats to an Open Source password manager to “be blocked by relying parties”.
We can all imagine a future where each website pushes you to their individual, proprietary app for verification. We live in a world of enshitification. Passkeys can, and probably will, be used for vendor lock in.
Giving websites control over (or even knowledge of) which client the user is using is a very bad part of the spec. There has already been threats to an Open Source password manager to “be blocked by relying parties”.
We can all imagine a future where each website pushes you to their individual, proprietary app for verification. We live in a world of enshitification. Passkeys can, and probably will, be used for vendor lock in.