Passkeys sign a web origin. If you try to phish one, the token you get won’t be valid for the origin you’re trying to authenticate to. Eg you’ll get: Token{do

Passkeys sign a web origin. If you try to phish one, the token you get won’t be valid for the origin you’re trying to authenticate to. Eg you’ll get: Token{domain:hax0r.net username:bob}