Since you lose the "something you know" factor with passkey-only authentication (e.g., with face scans), would it not be better to allow to add a (much shorter due to the passkey) password as well as an optional extra factor?