FWIW people don’t actually understand how passwords work either (password hashing etc.), and I am not sure it’s important for most people to understand how passkeys actually work. Also, majority of people reuse the same (extremely weak) password, or they go through an account recovery flow every time they login anywhere. This is why you saw the “magic link” pattern take off in the first place — users were already going through essentially the same flow before. Now at least they can sign in with biometric authentication on a regular basis, using passkeys. And if they do get locked out of their account for some reason, they go through the account recovery flow — same as they did when using their password before.

But at least they won’t get phished anymore! That’s a huge win.