tl;dr: Rebutting a viral "Passkeys are a trap" post, the author argues its central concern—attestation being used to lock users into approved software—is misguided: synced passkeys from iCloud, 1Password, etc. don't send attestation, and the post's recommended alternative (YubiKeys) actually does attest. The suggested fallback of TOTP is also phishable via tools like Evilginx, whereas passkeys are domain-bound and phishing-resistant. The advice: keep using passkeys with a trusted manager.