Partially true, but it changes when they ask to stop something, and you need to delete 20 «WHFB» passkeys :)

Old style - yes, but there is pretty neat options. Consumers never touch certificates, they just exist in their TPM :)

Passkeys is much better then whatever people use now, but CBA is actually good with governance