Replace the Passkey / Password / SSO tabs, identity-type picker and verification-method picker with a single form: handle (with the .fae.mom suffix and live availability), email, password with a show toggle, an invite code only when describeServer requires one, and the Turnstile widget only when it advertises turnstileSiteKey. Accounts are always did:plc and verified by email. SSO providers render as "Sign up with <provider>" buttons above the form, and migrating is a small link. After the email code (or link) is confirmed the flow has a full-access session from confirmSignup / createSession, so it offers an optional passkey through com.atproto.server.startPasskeyRegistration and finishPasskeyRegistration before completing the OAuth request with the password via /oauth/register/complete, as before. Skipping, or a browser without WebAuthn, goes straight on. The handle check now hits this PDS (/oauth/sso/check-handle-available) instead of https://<first user domain>, which was the wrong host when user domains differ from the PDS hostname. /oauth/register-password and /oauth/register-sso render the same page. The SSO completion page loses its identity and channel pickers too. Saved registration state moves to version 2 (no did:web data); older entries are discarded. Copy lives under the new en.json "signup" keys; other locales fall back to English.