Honestly, I don't understand them well enough to recommend them either. I do IT, and I set my users up with a (managed) password manager and MS Authenticator. If I encounter a situation where a user has ended up with a passkey for a given service, I just leave it be. On the other hand, if someone is locked out because of a passkey, I reset it and get them set back up with the Authenticator app.