What is the easiest way to have a standalone implementation of Passkeys on generic hardware with backup?

Question

In previous question I asked about simple login systems, and WebAuthn was the answer. From a brief read of the web pages I THINK it is possible to create a standalone GPL implementation of Passkeys that can be freely backed up/duplicated to protect against loss and can run on generic hardware/virtualised environment with Vaultwarden server (install via docker is the recommended method) and Bitwarden client on the same device, with some connection shenanigans related to "Web Crypto APIs". One could then take a copy of the whole container or just /vw-data/, securely back that up and use it to restore access to ones Passkeys if the device is lost or broken.

It kind of seems like a bodge to me, and not easy enough for most people. Is there an easier/sanctioned/GNU way to use Passkeys to log into websites using generic hardware, not requiring third party services and allowing backup to protect against loss of access to ones primary device? Comment on my scheme is also welcome.

Answer 1

The KeePassXC password manager supports software passkeys. They work on generic hardware and can be backed up. I would strongly recommend against trying to implement your own scheme.

Note, however, that software passkeys which can be copied will never reach the same security level as a hardware token. They aren't particularly convenient either, since you'll have to protect them with a master password (or something similar). Hardware tokens can be backed up simply by registering multiple keys (and in the future, there may be even better solutions). So unless you really want to avoid spending any money, a hardware token seems like a better option.