Passkeys remove phishing as an attack path, but the rollout itself raises questions that don’t come up in a demo: what happens when someone loses their device, or switches phones, or never enrols a second one.
This recap walks through how early enterprise deployments have handled fallback authentication and recovery without quietly reintroducing the weaknesses passkeys were meant to remove.
