Passkeys and the Quiet Revolution in Corporate Crypto

I edited the post and added this:

> In practical terms, this replaces a lot of the awkward machinery behind encrypted systems. End-to-end messaging usually requires long-lived identity keys, recovery phrases, or some form of server-assisted key escrow. Encrypted SaaS products often rely on password-derived keys or server-stored wrapped keys for recovery. Using passkeys and the WebAuthn PRF shifts that root of trust into hardware-backed credentials that already exist on user devices, reducing both system complexity and the number of high-value secrets stored on servers.

I hope that makes the reason for my post clearer? Thank you for your comment, I'm pretty new to writing blog posts and your comment identified that I clearly hadn't properly communicated why I though the approach was novel or exciting. It might have been obvious to some, but having Moxie do it in a product makes it much easier to justify by coping his approach.

Agree that the idea of using passkeys for encryption isn’t Moxies or novel, since it’s explicitly in the spec. MaybeI failed to get at what Moxie’s implementation replaces and how that’s novel, and moving the ecosystem forward. I could see a similar system being used for E2EE messaging too.