Optional Secondary Encryption Layer for Passkeys (Pepper-like Protection)

Additional encryption for items protected by Master Password Reprompt is indeed similar in spirit, though it does not make it explicit that peppering is a workaround for passwords, while there is no workaround for passkeys. Also applying this idea to passwords instead of passkeys is a bit more challenging, because in order to be able to use a simple additional “pepper password” by taking profit of target service rate-limiting, decryption of a password with the wrong “pepper password” should look like a plausible password, which is a bit complex to ensure, compared to a plain binary passkeys, which is why I preferred not to mention it initially.

So if my FR cannot be kept open, I would prefer moving it to the other FR in order to express these points (but otherwise I can also add a dedicated comment in the other FR).