Comment by wmf

Passkeys really can't be phished because they're site-specific and they can't be stolen because they're kept in the secure enclave. It's worth looking into the details.