https://nonfunctional.substack.com/p/passkeys-are-a-trap-do-not-use-them

TIL that passkeys have support for remote attestation built-in. Once enabled by a service, without a US-American phone running software signed by a US-American company, on which you need to be signed in with your legal identity (thus rendering you unable to use it if you're sanctioned by the US), there is a pretty good chance that you'll be unable to use your passkeys in the future. That seems pretty damn terrible.

Don't use passkeys.