It doesn't handle these either - what stops the user from entering their password on an attacker-controlled phishing page? Passkeys work because the user can't

It doesn't handle these either - what stops the user from entering their password on an attacker-controlled phishing page? Passkeys work because the user can't be tricked into entering their private key on a phishing website.