Authentication Today

The user holds a private key; the server knows the public key. The server issues a challenge; the user signs it with the private key. : SSH keys, WebAuthn (passkeys). Phishing-resistant because the private key never leaves the device and the challenge is bound to the origin.