Considerations for Replacing Password-Only Authentication with Passkeys