IMO teaching people about passkeys and making the onboarding experience as easy as possible would be many times more effective at actually preventing phishing.