Passkeys are absolutely fantastic. Pretty much every complaint you see in these threads is seen as a positive in an enterprise context.
> Attestation restricts passkey clients
GOOD. I need a way to prove passkeys live on hardware-backed crypto devices (see NIST SP 800-63B), attestation makes that possible.
> But auth lock-in
GOOD. All our corporate sign-in events should be through our single IDP using SSO. Of course we want lock-in.
> But I can't sign in to my children's devices
GOOD. An identity represents a entity, it should be impossible for you to pretend to be another entity, regardless of whether they're a child or dog or whatever. If you need "parental access" or similar to some accounts, contact your service provider and ask for that feature.
> It's hard to export my passkeys
GOOD. Encrypted or not, a core security tenet is "a private key should never leave the device it was generated on" (hence the existence of HSMs, TPMs, etc). It should absolutely be impossible to ship your private keys around. Further, the primary appeal of passkeys in our context is phishing resistance, and it should be technologically impossible for a user to get bamboozled into exporting and sending their passkey to an adversary.
> But I need my backups
Why? Just contact IT if you lose your credentials. If you're on the personal side and don't have an IT authority, you should just generate passkeys on multiple devices and add all of them to your accounts.
> But that's a pain
Security is almost always inversely proportional to convenience.
My workplace uses Duo Mobile for a second factor, which is functionally identical to TOTP, and probably uses TOTP internally (if your android phone is rooted, you can export Duo Mobile keys to your choice of TOTP app). But as long as I'm being a good corporate citizen, I can't use my choice of TOTP app. What actual security (non-theater) interest does that serve?
Duo is regularly audited by independent third-party assessors to attest SDCL, data protection in their datacenters, etc.[1] Audits aren't a guarantee but they provide a reasonable amount of assurance that their software products and infrastructure have at least basic data protection measures.
> if your android phone is rooted, you can export Duo Mobile keys
This is the exact reason why personally owned devices, in most organizations, require MDM enrollment and attestation before being granted access to corporate resources.