Try setting it a bit further back away from the wrist bones that stick up so that the sensors are in constant contact with the skin, and can illuminate the blood pulses in the vessels under the skin.
Exploring World of Warcraft just out of beta in the Elf staring zone will always be very special to me. An mmorpg in early 2000’s was a very new and exciting thing
The email is a replacement factor for the password, so this is still 1FA. This would also be an issue if email was a recovery factor for either password or MFA.
I always advise people to MFA their email accounts because that’s where all password resets are sent making it single target for many account takeovers.
2 factors - something you know and something you have. The device is what you have, the pin is something you know, otherwise anyone can pick up your security key and use it
Passkeys are deliberately designed to avoid the issues with Bluetooth pairing. This is why a QR code needs to be scanned - devices do not need to be paired.