[Shank]

A passkey is not a single string? A passkey is a public private key pair where the private key is never sent to a server and signs things.

[frollogaston]

Yep. There is still a lock-in issue though, cause passkeys as implemented are hard to transfer across walled gardens. But at least it's not like early TOTP impls which often had no playbook for when you get a new phone even in the same ecosystem.