I'm a fan of this , though on local scope this seem to be more difficult because it needs to be integrated in OpenWrt and I believe last time when I checked Fido2 it needs a domain to resolve for passkeys.
I know there is a git pr on the openwrt repo, currently only for OTP, but it is at least something.