If you only want first-party, you can presumably implement the spec yourself and do whatever you want with the data?

My example was only to point out that there exist self-hostable passkey providers.