Strong authentication

The first passkey can be enrolled with your password, then asserted. After that, another passkey requires a live passkey and a recent assertion. Revoking the last passkey does not allow password enrollment again. There is no in-product recovery.