If the passkeys were stored in some cloud KMS, then yes someone could still impersonate me. Ideally, but they wouldn't be able to steal the keys, it would only

If the passkeys were stored in some cloud KMS, then yes someone could still impersonate me. Ideally, but they wouldn't be able to steal the keys, it would only be temporary. That said, yes, we'd have to trust the server side software that grants access to the keys in KMS. In the end this level of indirection would sort of defeat the point. It wouldn't really be better than OIDC using a provider where you have a passkey. Incidentally, I have 2FA on important accounts, and prefer to use Google/GitHub/Facebook for sign-in on other sites whenever possible.