The user picks the passkey, don't they? Android, Apple or Microsoft. Or Yubikey, or another token.