Why do they have to create the secret key for me tho. That's now how it works. It means that they have a copy of my secret key even for one little moment. I can't tell what they do with that.

We have WebAuthn/passkeys for a reason. It has a bit of the usual W3C bloat but works well enough.