Hacker News Reader

I don't want to use passkeys until I can chose and verify that they are device bound.

KeepassXC famously has no network sync of any kind and supports passkeys.

Use a hardware token (eg. yubikey) then?