The site has a hidden webauthn trigger[1], an anti-pattern that automatically logs user in via passkey if it exists. A better approach, IMO, would be requiring user to click "log in".

[1]: `<input type="text" autocomplete="username webauthn" style="position:fixed;top:0;left:0;width:1px;height:1px;opacity:0;pointer-events:none" aria-hidden="true" />`