## 7 Lessons Learned and Discussion  
As per RQ3, this paper aims to validate the possibility of deriving a relative number regarding the adoption of passkeys among end users for online authentication. Attempting to evaluate the current state of adoption for passkeys, we note that not much research has been completed in the area. Of the few papers that contain relevant data for this research question, all use some interview to gather data. Of the interviews, the two most notable are firstly a 94 participant user study from 2020 in [7], also mentioned in [39], which looks into the usability of passwordless authentication, and secondly, a study with 279 participants in [94], focusing on general authentication patterns. Both papers quantify to differing extents how users evaluate passkeys and what is hindering their adoption. Still, due to the low amount of current research on this area, it is impossible to put exact numbers on how many are using passwordless authentication and thereby evaluating the current adoption for users. Furthermore, since the few relevant studies still contain relatively few participants, this raises questions about the statistical significance of the results. The best estimate that can be found for describing the current adoption of passwordless authentication among end users is that 3% of participants in Ref. [48] from 2021 used or had tried passwordless authentication. Because of the limited data available, we try to give an indirect estimate based on the availability of passwordless authentication in the current landscape of online services, etc. This form of data regarding the support of companies for passwordless authentication is available in larger quantities through the effort of various communities trying to obtain an overview. Looking at a set of large corporations' services, some of the major service providers are at the forefront of implementing FIDO2. A few examples of these are Google, the Bank of America, PayPal, and Cloudflare [8]. All of this suggests that the FIDO2 technology is at a point of higher adoption at large corporations and their services. In contrast, the little research that is available for measuring direct user adoption suggests that users are still reluctant to adopt the new technology,  
Figure 5: Illustration of the mapping between the identified challenges and existing proposed improvements in the literature. Furthermore, it highlights the gaps in the existing literature where only challenges have been identified with no proposed improvement. seeing some technical challenges and especially issues in the domain of user perception [39]. This is in line with the insights described in the detailed insights, where it can be seen that, due to the described challenges in the category of user perception, there is still a relatively slow adoption of FIDO2 support among companies and end users [27; 39; 48; 103]. Having looked at the current academic research from both angles with challenges and improvements in three different categories, we argue that overall, the current state of academia suggests passkeys bring numerous benefits for end users, and therefore, have the potential to revolutionize the authentication system, while at the same time still seeing major challenges in the user perception of passkeys. This is reflected in the current adoption of this new technology, with more and more companies adding support for this form of authentication. At the same time, users are still slow to adopt the new authentication technology. The _technical_ improvements mainly reside around the fact that the 'human factor' is taken out from many steps in the process since, for example, there is no need for creating a complex and long password. Apart from that, passkeys also do not require the end user to put trust in the service or website regarding the handling and storage of their authentication credentials.