Source: Michael Tsai
Passkeys' security model relies on device attestation to verify that a key genuinely lives on a secure enclave. But attestation creates a chokepoint: platform vendors (Apple, Google, Microsoft) decide which devices, manufacturers, and software stacks qualify as "trustworthy." They become gatekeepers of authentication infrastructure. The centralization mirrors earlier lock-in patterns in mobile ecosystems. A convenience-first authentication standard marketed as open ends up concentrating control over identity verification among a few corporations who can refuse attestation for competitive advantage or regulatory pressure.