Totally agree. I’ve been digging deeper into passkeys recently and seems like there are some noteworthy design flaws, this being one of them.

For high-value accounts, i think passkeys ultimately need to be a convenience factor layered on top of a less brittle root auth method (email, recovery phrase, etc.)

I've got doubts about passkeys as a singular authentication method but would love to be convinced otherwise

+1

Lack of portability also introduces a lot of problems/edge cases for any application that chooses to start with passkeys as a primary auth method then introduce additional factors later on.

Agree. Passkeys are a bad solution for accounts over X amount of value. 

The risk/reward balance becomes off kilter.

Personally think PassKeys will evolve from a great onboarding flow into more nuanced control like "session keys" and "social recovery" for more mature smart accounts.