A practical passkey rollout checklist for small businesses: where to enable phishing-resistant MFA first, how passkeys differ from passwords, and how to avoid recovery mistakes.