Passkeys can make signing in feel pleasantly uneventful. I still want to know what happens when somebody loses access to the device or account they normally use. A good login experience should survive an ordinary bit of bad luck without turning recovery into either a security hole or a support nightmare.
WebAuthn gives services a public-key authentication mechanism. That solves an important part of signing in, but it does not define your whole account lifecycle. The product still needs clear decisions about registering another credential, removing an old one and proving ownership when the usual route is unavailable.
For me, those decisions belong in the design before launch. Make it obvious which sign-in methods are attached, let people prepare another route where the service supports it, and explain what recovery can and cannot do. Avoid asking users to discover an obscure setting only after they are locked out. Recovery should also avoid casually bypassing the protection that made the login secure in the first place.
The successful version is boring: people understand how to get back in, support knows the limits, and unusual requests have a defined process. “We support passkeys” is a useful feature. “You can still use your account when your phone breaks” is the experience people will remember.
