WebAuthn doesn't use biometric data, the authenticator does. You can just as easily use a PIN or whatever you want.
> Also, single encryption key is risky (in the way as using the same password across all websites) as it could be hacked or leaked
The difference is that one compromised site can't leak your encryption key, someone would have to physically get it from your computer or steal your security key (and, probably, need to guess the PIN in three tries).
Except the standard permits sites to only trust authenticators with specific features, or rather from a specific whitelist of manufacturers/models:
https://www.imperialviolet.org/2019/01/01/zkattestation.html
Of course, not every site will make use of this DRM-like anti-feature, but I can well imagine that a lot of sites/industries will adopt policies that treat non-biometric authenticators as insecure.
This is partially because it serves as a fingerprinting vector for authenticating users, and limits functionality (such as reusing the authenticator to access multiple accounts on the same site). This UX penalty will most likely dissuade people from limiting authenticators in cases where they aren't trying to meet AAL3 or rough equivalent.
Once you have an authenticator attestation, you can tie it to metadata on features, certification, and security incidents.
However, I actually don't suspect that real-world policy will rely on such dynamic metadata. Instead, organizations will limit the allowed authenticators to a static set of models, most likely models they issue to users.
So you'll see things such as banks allowing large money transfers only when you use the bank-issued authenticator, or having government contractors only able to authenticate into systems using the key fob they were issued.
For personal accounts at least my experience was that a very large transfer (hundreds of thousands of dollars in a single transaction) required talking to two random employees. The first was a random call center worker who answered my call & the second was randomly chosen by the bank to run the whole process with me again to confirm. The web UI was clear that I would not be able to perform my transaction without talking to a human. Using two at random defuses the risk of internal collusion to defraud a customer. But I did use my good bank, maybe a mediocre bank would accept something a bit less stringent.
If someone "steals" your fingerprint or your PIN, they still have to seize your key fob/phone/laptop.
The biometric data or PIN does not leave the authenticator (although the browser/OS may be responsible for capturing the PIN for a key fob with limited input capabilities).
The devices also have security and biometric testing/certification, so users who are concerned about the data being hacked or leaked from that device in your possession can look for a certain certification level.
Yes, it is unlikely that a pure biometric as the sole factor with remote verification would ever be secure enough to be a single, lifetime authentication method. It would require a zero knowledge challenge/response against some biological process, with no false positive/negatives (even in cases of family members/twins with similar features/DNA). There's also legal reasons I'd want to stop being identified as that person (witness protection program being the one that jumps to mind).
It's far more likely we would go from wearables to implanted hardware, which would still be a two factor authenticator.
So while yes, ideally you’d use a hardware-secured key, which unlocked that key using a biometric or PIN, that’s not the most common workflow.
The exception is devices like the Google Pixel where it’s using a built-in hardware security device.
EDIT: Unfortunately, it looks like the WebAuthn credential is only used as the second factor, so you can't use it to replace your password yet, let alone your username.