I am not answering your questions, but just want to raise a thought.
Passkey’s implementations now seem to allow you to login bypassing passwords and MFAs altogether. The security question is, is having your phone and PIN enough to secure all those accounts that you have passkeys on the phone?
There was a post recently that the OP was robbed of the phone, and was forced to hand over the phone PIN, and a banking password. Can you get into this situations? If you can, then can your tolerate the robbers having access to your passkeys?
This can happen even without passkey. Steal a phone and force the guy to give you his password manager password. Or force to put their finger on the FP reader and add the robber’s fingerprint to the phone.
Yeah, the guy didn’t get asked for a PWM’s or TOTP App’s PINs/passwords, though. I personally changed my access to BW’s & TOTP App to app PINs, no longer biometrics. I hope I put in enough obstacles so that the hackers/robbers pick the easiest lowest-hanging fruits first, but I guess to each his own.