I’m confused. If I meet the requirements to generate a passkey, why do I also need to enter a one-time password or confirm in an app on another device?