The best passkey rollout plan is not "wherever it is available first." It is "wherever compromise creates the largest downstream blast radius."
Primary email accounts, cloud admin consoles, finance platforms, code hosting, and identity providers sit at the center of the account graph. Harden those first and you make everything else harder to reset, impersonate, or drain.
This approach helps teams prioritize scarce rollout effort and creates a clear sequence instead of an abstract security aspiration.