Oh, I was wondering if it was that in the other thread! But in that case, this really is just how passkeys work. The public key is the passkey, and clientId is

Oh, I was wondering if it was that in the other thread! But in that case, this really is just how passkeys work. The public key is the passkey, and clientId is a "key handle" (sometimes it's the private key encrypted with some root key stored on the hardware authenticator; sometimes it's just a database ID). The device UDID should definitely not be available to relying parties though (WebAuthN is privacy-focused; the only allowable identifier is one that's shared across at least 100 000 devices), so it's confusing that Apple lists yours in their data export. My export is currently pending; I'm curious to see what they're storing for me.