An authentication factor can be one of 3 things: * something you know (a password or pin) * something you have (a cryptographic key) * something you are (a biom

An authentication factor can be one of 3 things: * something you know (a password or pin) * something you have (a cryptographic key) * something you are (a biometric, like a fingerprint). Generically, "passkey" refers to a FIDO2 passkey which is a cryptographic key PLUS (preferably) a biometric prompt or (more weakly) a pin or password. You cannot use your key to sign a challenge without the 2nd factor. A password protected SSH key is effectively a weak FIDO2 passkey. > why can't we do website auth with your installed keychain You can. This is roughly Apple's implementation of FIDO2