Major implementers are definitely over-complicating things; making perfect the enemy of the good in a way that's hindering adoption. They want to make phishing impossible, not just "really hard", and doing that requires portability features to be ridiculously over-complicated and somewhat at odds with user freedom. In my opinion they should give up on that for now and just let users export a plaintext database the same way they can with any other password manager.

Regarding b) it's extremely simple. Passkeys are private keys (like SSH), stored in a password manager, accessed via JavaScript.