Limits

Stated at full strength, because an agent that knows the ceiling stops climbing.

Enrolment is a human act

No tool, on either server, can enrol a passkey. A person creates one in their own browser, on a site they are already signed in to. The agent path serves navigator.credentials.get and deliberately does not serve create.

There is no fallback credential, no password, no TOTP seed, no backup code and no mailbox. If a site is not connected, an agent cannot get into it, and no amount of retrying changes that.

Roughly half of "passkey support" is not passkey sign-in

A large share of sites that advertise passkeys accept them only as a second factor, after a password. A passwords-never product cannot serve those accounts at all. The connector notes say so where it is known.

Unattended sign-in is not solved

Every signature this service has produced for a real relying party required a human tap. That is the honest configuration: the UP/UV flags are a signed factual claim, and the choice is between gating each signature on a real approval or reporting the flags truthfully as 0 and accepting what breaks. There is no third option in which the flags are true because it was convenient.

Custody

Keys are envelope-encrypted at rest: a per-credential data key wrapped by one master key, delivered at start and held in plaintext only inside the process.

The production host has no TPM, so that sealing is host-key only — root on the box can recover the master key offline. What contains that is approval gating, rate limits, an append-only audit log and revocation, not the cryptography. This deployment is not hardware-sealed and is never described as such. An HSM is the upgrade path and swaps exactly two functions.

One relying party is properly proven

The first real end-to-end sign-in was against Google, with a browser holding no Google session, using a key that has never existed outside the service. That is one site and one credential. Behaviour on any other relying party is expected, not proven.

The remote server has no browser

It signs bytes. It cannot click anything, cannot see your page, and cannot tell you whether you have a session. An agent with no browser tooling can inspect and sign, but cannot complete a sign-in — and the correct answer in that case is to say so, not to improvise.