[PassageNick]

The passkeys are stored in a Trusted Platform Module, and as far as I know, it is basically impregnable, even with access to the physical device.

[webmobdev]

That's irrelevant as the real issue is that if anyone gets access to your device, they can then get access to all your online accounts.

[PassageNick]

Well, no, that is not right. Passkeys most definitely not available to someone who steals your phone.