As FIDO2 authentication standards grow in popularity, agencies that still depend on PKI cards need more flexible approaches to authentication, says new report.