Encryption vs Authentication: The Architecture Guardrails You Need After the Passkeys Critique

import Tabs from ' @theme /Tabs'; import TabItem from ' @theme /TabItem'; Somewhere a team is shipping a product that uses passkey credentials as data-encryption keys, and they are genuinely proud of the elegance. They will be less proud the first time a user switches phones and watches their data evaporate. The passkeys critique made this failure mode impossible to ignore — so here are the guardrails I would enforce in any architecture review before that elegant design reaches production. Why Authentication and Encryption Must Stay Separate "Authentication proves user identity. Encryption protects data confidentiality. These controls can interact, but they must not be the same key lifecycle." ⚠️ Caution: Reality Check When a team derives encryption keys directly from passkey credentials, losing the passkey means losing the data. This is not a theoretical risk — it is the default failure mode for normal user behavior: switching devices, resetting accounts, or changing authentication pr