Regarding the line

Someone needs to decide first whether we want to push forward at all. Arguably the technology is not that mature yet (see e.g. https://arstechnica.com/security/2024/12/passkey-technology-is-elegant-but-its-most-definitely-not-usable-security/ or this recent vulnerability) and used on few other large websites.

That number has increased as according to findings from the FIDO Alliance, 48% of the world’s top 100 websites
have already integrated passkey support. (https://fidoalliance.org/wp-content/uploads/2025/04/World-Password-Day-2025-Final.pdf)
We can also see that many companies are actively working to increase passkey adoption and usage including amazon, Microsoft and google: https://fidoalliance.org/passkeypledge/#See-Who-Has-Signed-the-Pledge

I accidentally copied name from wrong downstream feature request. Fixed.

Regarding recovery, perhaps to go fully passwordless users could be required to either have at least 2 passkeys OR one synced passkey (if we can detect this). If a user only has 1 local-bound passkey it should still bypass password but login via password + 2fa could still be possible to prevent lockout.
Alternatively passwordless with only 1 passkey regardless of type could be allowed BUT users then would be required to verify saving recovery codes by using one upon creation of their first passkey to ensure a recovery method.