Are Passkeys a Trap?

Jim Taylor rebuts an anonymous essay claiming passkeys let websites use attestation to control which software people run. He argues attestation is optional, most consumer sites don't request it, and major software managers seem to return none. The AAGUID, a model identifier, can be spoofed and reveals little about the OS or browser. Some banks, such as Docomo SMTB Net Bank, do restrict managers. Several of his claims, including FIDO membership figures, are unsourced or unchecked. For builders, AAGUID allow-lists suit policy guidance, not strict enforcement.