On Wednesday, the FIDO Alliance put HID — an access-control company, the sort that sells the readers your office badge taps — on its board, in a release promising to “drive global enterprise passkey adoption.” The same week, the internet spent 674 comments on Hacker News fighting about a blog post titled “Passkeys are not a trap.”

Two passkey stories in one week. Only one of them is about the passkey market.

The Export Spec Solves a Problem Your Employer Doesn’t Have

The “trap” argument is a consumer argument. You put a passkey in Apple’s keychain, you move to Android, the credential doesn’t follow, and — the claim goes — you’re locked in. The rebuttal is that FIDO’s Credential Exchange Specification lets credentials move between providers, so the lock-in has been fixed and everyone can relax.

The rebuttal is correct and beside the point. As identity engineers have argued since at least last December, the friction was never the file format. It’s the platform standing in the middle of every step: the prompt, the sync, the recovery flow. A credential you can technically export from a place you can never practically leave is not a credential you own.

Now ask who is buying passkeys at scale. Not you.

FIDO’s own State of Passkeys report, released May 7 for World Passkey Day, leads with the consumer numbers, which are the fun ones: 90 percent awareness, up from 75 percent a year earlier, and 75 percent of consumers having enabled a passkey on at least one account. The number that describes an actual market is 68 percent — the share of organizations deploying, piloting, or rolling out passkeys for employee authentication. That is a buyer with a budget, a compliance deadline, and an HR department. Not a person with a phone.

And that buyer wants the precise opposite of portability.

68 Percent Is an HR Statistic

An enterprise does not adopt passkeys so its employees can carry a credential between ecosystems. It adopts them so a credential can be issued on a Tuesday morning and destroyed on a Friday afternoon — cleanly, in one console, with an audit log. Device binding is the feature. Every laptop becomes a revocation point that cannot be argued with. Portability is not a design goal of this deployment; it’s an obstacle.

Which is why the loudest fight in the field — Apple against Google against your password manager, over who holds the keychain — concerns the slice of the market that matters least. The load-bearing passkey rollout of 2026 runs through identity-and-access teams, onboarding workflows, and procurement. A junior administrator on the identity team at a regional health system put it to me in a Slack DM during a provisioning freeze: “Nobody on my floor has ever asked whether a nurse can export her credential. They ask how fast I can kill it.”

That is not cynicism. It’s a job description. And it is the answer to the question the whole debate keeps failing to ask.

One Credential for the Laptop and the Loading Dock

Consider what HID actually sells: cards, readers, controllers, the hardware that decides which doors open. Its new seat on the FIDO board is a statement about direction. The building credential and the login credential are converging on the same provisioning system, issued by the same employer, revoked from the same console. A company built on door access has concluded that door access and system access are one product.

Maybe that’s convenient. It is also the moment the “trap” question stops being about Apple and Google and becomes about your employer’s identity team, which is not a party to the Credential Exchange Specification in any meaningful sense.

Here is the part that ought to bother people who believe markets discipline this sort of thing. The standard free-market answer to lock-in is competition: users flee, vendors respond, portability wins. But when the buyer is the employer and the product is revocability, competition pushes toward less portability, not more. Every vendor chasing that contract promises tighter binding, faster kill switches, richer audit trails. The market is working exactly as advertised, and the result is a credential more firmly attached to an institution than any password ever was.

Passwords were, whatever else you say about them, portable in the way that mattered: they lived in your head. The 674 comments this week were lively. Not one of them was about the badge.

Sources