> I was forced to use a passkey implemented within the vendor's app

Sigh. It's OpenID (the original one) all over again? Everyone wants to be the auth provider, nobody wants to accept other auth providers.