Yes you need to trust your operating system developer to some extent. If your threat model includes not trusting the company that writes the source code to your OS…don’t use computers I guess?

Suppose one does trust their OS developers. And they want to use some passkey-protected service.

Does that service also have to trust the OS developers? Correct me if I'm wrong, but I'm under the impression that services can decide whose passkey implementations to trust.

Seems like that should be up to the user, not the service.

The user picks the passkey, don't they? Android, Apple or Microsoft. Or Yubikey, or another token.

The concern is not about trust but gatekeeping the providers.

For example in the case of email, you generaly dont worry about google reading your email but we should definitely be concerned if gmail allows send & recieve from only few domains or providers it chooses.

But no more than they are the gatekeepers of your password when you use their keyboard software, right?

How so