Thanks for the great answers! Glad that it was just a documentation issue for user ID and good to know which algorithms to support, although I guess most library implementations support all the major ones anyway. And sure, didn’t even consider that passkey sharing is only over AirDrop and hence you need to be physically close for the sharing to work. I guess the proximity requirement is also why the QR code is not possible to be implemented by RP (as that would require Bluetooth I’d imagine), and instead it has to be built by the platform. Even if passkeys could be shared without the proximity requirement (which I'm happy they don't), it occurred to me just after posting that another phishing protection built-into the WebAuthn standard (and thus passkey) over passwords is that you can't just send a scam link over email or sms that looks like yourservice.com and ask the users to sign in, as the platform authenticator wouldn't recognize the domain and provide an option for signing in there.

Is it possible to delete passkeys in macOS Ventura? I've been doing some testing with Safari 16 and have dozen or so passkeys that weren't successfully registered on the server. Would be nice to be able to clear them, but I don't see any options for that in macOS Ventura beta 3 (22A5295h).