Some questions to answer:
- What is/is not a passkey?
- How do you implement passkeys for various authentication frameworks (including legacy/roll your own)
- What do you do if your stakeholders/customers absolutely need passwords as a security blanket?
Reference materials: