And for services (like AWS) that don't (yet) support passkeys, a hardware token like a YubiKey is also an option.