If the worry is your phone getting lost then use a password manager that syncs to the cloud and log in with the same passkey using another device. I just got a new iPhone and logged into a bunch of things on-device using synced passkeys. It worked just fine.

Every conversation about this seems to involve someone asserting that improving upon passwords in any way at all is unacceptable unless the solution is perfect in every possible way, with the goalposts constantly moving.

Rate limiting doesn’t work when individual IPs are only making a handful of requests.

So that’s why we’re using CF/Fastly. Too bad, I’d prefer not to, but there is just not an alternative at this point.

I brought up the backup camera as another reason the head unit has CAN, since in my car that's what's handling drawing the backup guide lines.

The aftermarket HU would have enough data to do so, but in my case it doesn't (although it does read CAN for buttons/iDrive). The original HU is still there and functioning, but the aftermarket Android is between the vehicle harness and the original HU with some passthrough and swapping of video cables.

I can hold down the Menu button on my iDrive and the Android HU switches the screen to show the original HU output and I can interact with it normally. And when I put the car into reverse it also switches so I can see the original backup camera feed, then switches back to Android after I drive forward again.

Of course I use none of the Android functionality at all, the whole ridiculous system is solely for CarPlay.

I believe the connection exists because the steering wheel buttons/iDrive talk to the original head unit over CAN.

My personal gripe is their refusal to support restarting heading levels within sections, causing whole classes of problems with CMS templating.

That's about where IE 6 and then IE 11 were when everyone was excited they could finally drop them. Why should anyone treat Firefox differently?