Yes I can backup a software one. But that's not the point. Passkeys are advertised as the future for common people as they eliminate the biggest issues: phishing.

But then they don't advise people to use software passkeys, back them up and keep them save. Instead they tell them to configure an alternative/recovery login alongside the passkey should it be lost or damaged.

They take a security feature, instantly remove the additional security and make it into a "you don't need to remember and type your password"-convenience thing. Yeah, great. A password manager could've already provided that convenience.

So in the end those more technically-minded that will look at this and decide to use a software passkey so they can back it up will get some additional security they need much less (they are not the primary target group for phishing), and some convenience they already had (because they are already using a password manager).

Passkeys aren't controversial because they are bad. They aren't. They are controversial because the actual way they are used makes zero sense for the purpose of added security. Which raises the question what the actual goal is.