While passkeys (aka FIDO/WebAuthn) has its advantages, it is critical to understand that not all passkeys are created equally. To get another point-of-view that you are unlikely to hear from passkey promoters, it is worth 6 minutes of your time reading this article on LI:

“Would you trust your bank with both keys to your safe deposit box?”

Does the CMA not have the authority to fine such companies for violations? If it does not, then the situation will never improve. I suggest looking at the US' Consumer Finance Protection Bureau (CFPB)  - setup during the Obama administration - as an example of some good work they are performing. According to their websites, they were responsible for getting $20B returned to consumers of the life of the agency (probably around 10 years now).

About time government agencies took responsibility for protecting consumers. Rohit Chopra of the US's Consumer Financial Protection Bureau (CFPB) and Nikhil Rathi (FCA's CEO) appear to be a breed apart from agencies that are captive to corporations and their lobbyists - they are, hopefully, the vanguard of the kind of government consumers dream of.