You REALLY underestimate the motivation of organized crime and the absolute stupidity of the world wide user base. ^_^ Passkeys may prevent phishing, but they just move the attack vector around. Source: I run CIAM for a pretty fucking stupid user base.