I think that is only an issue based on what Passkey attestation is configured by the relying party? From what I have read a lot of public facing companies implementing it will have passkey attestation statements configured as None, which typically means there isn’t an authenticator certificate verification.

If you can’t drop the use of AI for your own learning, use it for learning. Tell it specifically that you want guidance on how to do something, not to do it for you, perhaps have it create a html guide you can follow without it giving you all the answers.

If it does something in a way you didn’t expect, ask why. Ask if the way it has done something is the best way of doing it, and then do a bit of research and challenge it when it’s wrong, and it will definitely be at times.

Charge people to go ad-free. Keep increasing the sub price over time, then provide a lower cost version with minimal ads.