For context, here’s the part I was referring to about the “catch them at login” / JIT idea:

https://mojoauth.com/blog/how-to-migrate-to-passwordless-fro...