I don't understand the reasoning, scanning a qt code provides a URL that the user may or may not visit. How is this an issue? I do agree that passkeys are problematic, though.