If granny forgets her password, she looks it up on the last page of her notebook where it is written down. Granny cannot write down her passkey.

To avoid getting locked out you could add 2-3 passkeys from different providers to each account. And/or use a passkey provider that allows backups, and back up your keys. But I doubt many people will have the discipline to do either of that.

Then that's worse, it's now two authentication flows to remember. It's only made the situation more complicated.

Honest question: isn't that introducing some weaknesses, allowing the attacker to either reactivate password auth or add it's own passkey eh by tricking the user in accepting that change after receiving a mail with a link to accept that change? That would make the passkey unbreakable, but leave other easier to exploit weaknesses.

The problem with passkeys is they’re very unfamiliar and it’s easier therefore for less experienced users to get confused or tricked.

Passkeys are more like 2FA, and many services disable password resets without 2FA if it's enabled.