also, passkeys get backed up in iCloud, so losing your device isn't really an issue. the disaster scenario is more what happens if apple locks you out of iCloud.
Most of my banks don’t support it at all, but the few that do still require SMS as a recovery mechanism. So it’s pretty pointless from a security standpoint.
Even O365 will keep pestering you to add a phone number for recovery if you go passwordless and remove your phone number. I think they may even force you to add it back in certain flows.
I think Apple has one the better impls and they went hard on account security after the rash of celebrity nudes were traced back to poor iCloud account hygiene. Recovery codes get sent to every device in the account with an option to decline, passkeys are first class citizens, and they don’t need to know my phone number for any of it
To your questions, the password safe can store passkeys as well. The entire point is to get to a place where we aren’t all dependent on some remote site’s security to keep our secrets safe. Why use a 25+ character password which can be compromised in a number of ways when a passkey doesn’t involve sending secrets at all?
When we implemented passkeys a few years ago[0], we chose to implement them as a purely secondary authentication method. So you had to have an account, then you added a passkey.
So you have the normal account recovery process if you need it, while you get the advantage of passkeys for improved, faster regular login.
That's obviously a tradeoff.
I wrote up a bit about this issue[1] last year but I think there's been some progress on standardizing backups of software passkey private keys[2]. The idea of syncing around a private key, no matter how protected it is, still makes me a bit queasy (as it seems you are) but I understand the motivation.
0: https://fusionauth.io/docs/lifecycle/authenticate-users/pass...
1: https://ciamweekly.substack.com/p/on-webauthn-and-passkeys
If I lost all my devices in a natural disaster I want way to be able to get back in to accounts. And personally I don't want that to be cloud-dependent (bit of chicken-and-egg dependency story, it seems, plus a centralized weakness). I might be misunderstanding the device-as-passkey story, but the stuff I've read about it hasn't seemed to proactively answer that question.