WebauthN seems to be better than OIDC in that as far as I can tell you control the actual auth part, but OIDC is the clear winner. That and just because it's open doesn't mean it's not a vector for consolidation of power. E-mail is like 90% owned by Google in the USA and it's an open protocol.

I was speaking very broadly. May have been a bit of a tangent.

All I'm saying is that authentication is literally the keys to the castle, and inviting third party control of authentication has some scary implications in terms of privacy, monopoly control, and security.

> If it syncs your keys, it has full access.

It does, but it doesn't have to. You can use any provider you want, or self-host.