Hi there, it is up to individual websites whether they require passkeys or passkeys + 2FA etc..

It is also important to note that most attacks are phishing-based, and passkeys are phishing-resistant, and will only work on the originating website.

Proton Sentinel also helps to protect account takeovers, even when an attacker has stolen your password.