In my testing, access to your passkey requires your _unlocked_ device (as opposed to a yubikey, which has no on-device authentication)