Operator sign-in
Avout has no password and no shared operator token to leak. The browser proves possession of an enrolled device, and the console receives a scoped cookie for that operator alone.
Passkey ceremony
Enrolment happens once, on an invited device. A device that has never been enrolled will find no credential to offer, which is the intended answer rather than an error to work around.