1. It's not that complicated

2. The complexity in the standard is there to ensure things are done securely (think: not doing password checking via comparison loop).

3. The unnecessarily complexity in individual implementations in websites and passkey stores is due to general baseline corporate "incompetence".