Yes, you can use kind 30078 with "ppq + thread id" as the d-tag
passkeys suck because you lose the device, you lose the account
We agree that browser extensions are bad, however nostr wrappers such as keychat and fedi go a long way to fixing this
You can also use Amber or even a hardware signer
Given that queries are often not sensitive, there's also an argument you could generate a local keypair, or accept a raw nsec. It's a start, at least, and would allow accounts (and history) to be shared, eg among a team