Passkeys: a seal instead of a password
How passkeys work, and why a phishing page has nothing to sign. Registration and sign-in step by step, plus a working minimum on SimpleWebAuthn: four endpoints on the server, autofill in the browser, and a passkey either instead of a password or as the step after it.