At Caution we -exclusively- allow passkeys. The entire database is user ids and public keys. If it leaks, it would only be mildly annoying.
If you are confused about digital passkeys, you can use a physical yubikey or nitrokey and tap it when it blinks. You can treat them like a credit card or house keys.
Asking people to keep up with and remember passwords is and always has been the thing that was invented with zero understanding of the consumer brain.
> -exclusively- allow passkeys
Isn't that just a euphemism for "we mandate passkeys"? Saying 'exclusively allow' draws the reader's attention to the positive (allowing!) while de-emphasizing what's not permitted.
Regardless, I think it's a lot less of an issue for services exclusively oriented at people in tech instead of just everyone. Even then, there is a barrier to adoption besides just understanding it, which is relying on new software or owning a piece of hardware. It's a lot messier, while text remains universal and has no dependencies.