Many years ago when I was on a trip to America I visited Brick Lane Curry House to do the Phaal challenge. It was described as excruciatingly hot. I’ve had a Phaal in the UK, and suffered through it.
They brought the dish out and it was no hotter than a UK vindaloo. I was quite disappointed when they gave me the Phaal curry monster certificate, I’d genuinely hoped for a challenge.
I think that is only an issue based on what Passkey attestation is configured by the relying party? From what I have read a lot of public facing companies implementing it will have passkey attestation statements configured as None, which typically means there isn’t an authenticator certificate verification.