I am being forced to configure a passkey in order to regain access to my HSA account. The UX remains disastrously bad and the provider has zero interest in serving existing users who have evaluated their own threat model and declined passkeys. I hope the folks who think this is a good idea are happy to have further entrenched the non-general computing device duopoly and enabled enshittification in the name of “security”. I’m sure the “think of the children” folks will be pleased with your work.