So does DRM. In the long run, web sites will end up requiring measured boot to use passkeys, and also require passkeys. This is already common practice with android (to prevent third party ROMs from working).