I only dislike the ability for service providers to enforce a “security level”. Those should be the exclusively under my (the user) control. Sending preferred default (hints) would be cool, but not enforcement.

That a webpage can basically prevent me from using a passkey if the passkey is stored in software (a password manager for example) is complete bullshit. Especially if there is still username/password as alternative which is clearly worse. Sure, hardware tokens are the ultimate security. But it should be up to me and not them if I want that level of security.