This is missing the forest for the trees. Phishing attacks won't ask you to reset your passkey - or if they do, they'll have to be much more complicated and targeted. This will dramatically reduce the attack surface threatening the vast majority of users.