When logging in through SSO, Tranquil requests TOTP, but doesn't offer passkey as a form of 2FA. Services like GitHub, commonly offer this as an option for 2FA, and since a login through this route is already implemented I think it should be doable.