This very much falls into the same box as “not your keys, not your crypto”: if you’re forced to trust someone else to manage the keys for you then they have them - necessarily, in order to permit “transfer” (under this scheme, not everything) to another party - in plaintext, while you’re not allowed to “for your own good”, then you’ve lost it all.
They can:
1. Impersonate you, gaining access to anything your keys unlock
1.a. Impersonate you, claiming to be you in a violation of “key use enables non-repudiation”
2. Deny you the ability to use your keys
2.a. Change any of your keys, locking you out of things
3. Deny you the ability to transfer your keys to anyone they “don’t like”
3. Provide your keys to anyone else, e.g. “with a court order”
3.a. Anyone “benefitting” under (3) can then do (1(a))
…and surely more Bad Things.
Every single time “passkeys” seems to like “okay, maybe”… some fucktards pull another one of these.
Then I go, “okay, ssh keys, PIV, or whatever else is Just Fine, and these people who are either state agents, idiots, or power hungry idiots working to advance total control over humans with lack of freedom and no way back can go die, or as an alternative be sentenced to serious computer-things-reeducation”. …and I kinda mean it. There are certain things you just don’t come back from, as a society, etc. and I just won’t support it. You only get one chance not to.
