Could you give an example? That support article doesn't mention anything about it. I do recall reading something about that recently, but I read the article and it it made no mention of what syncing passkeys actually means. It sounds like theoretically I could write an app that uses the same APIs Apple uses to sync encrypted credentials between TPMs. But "however you please" sounds suspiciously like "however you please, as long as you don't sync it to anywhere Apple can't vouch for the safety of the keys."

Which again, seems like the worst of both worlds.

It has been a while since I have dug into it, but from what I remember it works roughly like this:

You login to iCloud which gives your device write access to iCloud storage. The device creates a private key inside the TPM, and uploads the public key. When you add a new device, one of your existing devices has to use its hardware key to sign your new devices key. It also must be signed by a second key derived from your iCloud password (so you). Apple doesn't go into the details on this, but I believe the originating TPM also signs the key with a chain of trust that goes back to Apple itself.

The keychain is encrypted locally and exported to iCloud. The key used to encrypt the keychain is also encrypted using the public keys of all trusted device keys in iCloud that have both a signature from another trusted device and from you.

As a user you can also just open up Keychain Access on a Mac and ask it to generate a CSV export of your entire iCloud keychain - which is how you would go about migrating to another password manager.

I'm sure that works for passwords. I am skeptical that it works with passkeys. It's unclear to me if the CSV will include passkeys. It's additionally unclear to me if I enroll in some website with a passkey stored in my Keychain, and then export and import that password into some other password manager, if the website will accept a login from the exported passkey. Definitely, there's the "attestation" piece and services might choose not to accept the passkey if the attestation has changed. You can blame the service - but it seems like an intentional design goal here. And it has been said that Apple didn't want attestation, maybe it will be removed, but it's there and it seems likely to be used.