It seems like you are trying to protect against a compromise of the user's device. But if their device is compromised then their session is compromised after auth anyway and you aren't solving much with extra auth factors.
You’re assuming that the passkey is on their phone and the phone is compromised. Passkeys can also be stored in password managers, or hardware tokens, or people’s iCloud or Google accounts. And if someone’s device is compromised, they have keys to everything even if the user never logs into those services to grab session data. If someone compromises my password vault they get passwords, but not TOTP keys. If they compromise my vault that is holding passkeys, that is all they need.
I am only pointing out that a single factor is all that is sent to the sever, with most no longer allowing a secondary factor for authentication, and all of the security is all dependent on the client-side now.
If the user can perform all steps on the same device then it doesn't make sense to assume only specific set of keys will be disclosed, you have to assume everything on the device can be compromised
It seems like you are trying to protect against a compromise of the user's device. But if their device is compromised then their session is compromised after auth anyway and you aren't solving much with extra auth factors.
You’re assuming that the passkey is on their phone and the phone is compromised. Passkeys can also be stored in password managers, or hardware tokens, or people’s iCloud or Google accounts. And if someone’s device is compromised, they have keys to everything even if the user never logs into those services to grab session data. If someone compromises my password vault they get passwords, but not TOTP keys. If they compromise my vault that is holding passkeys, that is all they need.
I am only pointing out that a single factor is all that is sent to the sever, with most no longer allowing a secondary factor for authentication, and all of the security is all dependent on the client-side now.
If the user can perform all steps on the same device then it doesn't make sense to assume only specific set of keys will be disclosed, you have to assume everything on the device can be compromised