Doing ukemi to save himself. This is just the first step of the practice. Uke (receiver) co-operates in a way that tori can practice the thing being taught. Only after that things start to change: uke changes something, tries to evade, resists etc. However, this phase is rarely shown in demonstrations. Even more rare if you see the step(s) after that.
The worst thing about passkeys is how browser extensions must handle them: using JavaScript injections to the web page. Of course this means _any_ browser extension could do the same and be the man-in-the-middle inspecting the passkey creation and authentication.
I'd be glad to have some kind of standard API behind a proper permission for handling passkeys.
The only thing that they should be able to intercept there, though, would be the specific passkey for the page you are authenticating with. With the specific challenge that was included, even. Such that it is not exportable to somewhere else for them to authenticate as you.
Sure, it sucks that anything is interceptable. But this is still an improvement over the status quo.
