My major objection to security keys is simple: I am a forgetful motherfucker and I will lose a tiny physical key within hours, and the backup immediately after that
https://www.theverge.com/2023/11/15/23962443/google-titan-security-key-passwordless-login
Nah. It does a per-site cryptographic signing. There's no way to track them cross-site without you doing something like using the same login.