You can use your system keychain (iCloud, whatever chromeos/android use) or your password manager (random software) that integrates with your OS/Browser to mana

You can use your system keychain (iCloud, whatever chromeos/android use) or your password manager (random software) that integrates with your OS/Browser to manage a passkey. I use 1Password to manage my Passkeys in Edge, and that vault can only either be unlocked by A) my master password or B) my Windows Hello Pin code (after I've used my master password at least once). If I use my mobile device, then it's FaceID or a fingerprint or my PIN, etc. So, you instead use a password to unlock the device -- something you know -- rather than giving the website the password, and then offer up a cryptographic proof that you're a specific user -- something you have, much like TOTP works today. WebAuthn keys are also unphishable and don't leak usable information for other websites by design. If you already used a password manager the second one was to some extent true, but no phising is a big one. It is basically a different take on the same ideas behind SSH key exchange, yes. Though in the case of SSH, you have both the transport (Secure Shell) and the key exchange/authentication system. In theory you could use WebAuthn keys or something to negotiate a Secure Shell transport and replace SSH keys; after all, you can already replace it with certificates, etc. So there's mix-and-match possibilities. Some systems like 1Password apparently even have support for acting like an SSH Agent and storing your SSH keys, too. I don't use it, it nagged me about it the other day, but this would further consolidate all these separate storage mechanisms into one place. Basically, the unifying idea here that everyone is converging on that you just use a single password or short-term session (FaceID, etc) to unlock some shared, encrypted vault containing everything else -- and that "everything else" can include randomly generated passwords, cryptographic keys (Passkeys, SSH Keys, etc), other proofs and info (TOTP), etc. that you then offer on demand. So there's a unified UX to all these things.