The web is a wonderful place: open, permissionless, linkable and composable, but also a dangerous place with so many actors: vulnerable and malicious.
Self-custody key is difficult, and Passkey is, in effect, going to be a custodial solution, so you need a separate app outside of the web, but this is friction.
The ideal is to structure the isolated and secure environment and bridge only the results of signing/decryption to general web apps/extensions, with fluentness. Here is one of paths to it.
For example, it enables users to:
