I just got a LLM to write a user script that blocks pass key requests:

    (() => {
      // Sites check `window.PublicKeyCredential` to decide whether to offer passkeys.
      try { delete window.PublicKeyCredential; } catch (e) {}

      // Block passkey requests from sites that skip the check. Password/federated credentials still work.
      const creds = navigator.credentials;
      if (!creds) return;
      const refuse = () => Promise.reject(new DOMException("Passkeys are disabled.", "NotAllowedError"));
      const origGet = creds.get.bind(creds);
      const origCreate = creds.create.bind(creds);
      creds.get = (opts) => (opts && opts.publicKey ? refuse() : origGet(opts));
      creds.create = (opts) => (opts && opts.publicKey ? refuse() : origCreate(opts));
    })();