Let me address your questions in reverse order. > I have a set of passkeys on my phone and the phone gets stolen. Do I instantly lose access to all my services

Let me address your questions in reverse order. > I have a set of passkeys on my phone and the phone gets stolen. Do I instantly lose access to all my services? Probably not, because the keys are still in the cloud, but then how do I authenticate to Google from a new device? In general, logging into your password manager with a passkey is probably the least compelling way to use passkeys; you'll need some kinda backup code (i.e. a password) to avoid losing access to the password manager and the passkeys inside it. The company 1Password calls it that because, yes, you're probably going to need to memorize/retain one last password, the one you use to login to your password manager. If Google is your password manager, then, yeah, you're going to need something outside the password manager to login to the safe and get access to your passkeys and other passwords. You'll probably need to use a password for that. But https://myaccount.google.com/security https://myaccount.google.com/security lists a bunch of alternatives: • TOTP authenticator • Google prompt on multiple devices (login to YouTube on another machine? use that as a second factor) • Recovery email • Recovery phone • Backup codes (one-time passwords) If you lose your Google password, you'll have go through Google's password reset process. It can be hellish, but if you've set up backup codes and recovery contacts, you'll probably be fine. > But what happens if I have my passkeys stored in a Google account or whatever and then Google decides to ban me? Do I permanently lose access not just to all Google services but also to all services that had a passkey stored? Yeah, you lose access to your Google password/passkey safe when Google bans you. (It depends a little on how you got banned. If you're an identified persona non grata, sometimes they'll let you export some of your data with Google Takeout. If you're locked out of your account (because you lost your password and all of your other factors), well, of course you can't access your password safe at that point, because you can't prove your identity to Google.) If Google is your password safe, you really must set up backup codes, and you need to keep them safe. That's true regardless of whether you use Google passkeys or not. Either way, it sounds like maybe you don't want to trust Google as your password manager. It's perfectly reasonable to mistrust Google. There are a number of good alternative password managers that support passkeys; consider using them instead. > How would I "move" the passkeys, as they'd still be tied to the old domain? You can't really "move" passwords, either, because any phishing site could claim to be your site. ("We've moved! Please enter your password for example.com here. hehehe") But, while you control both sites, you could log people in on the old site and then redirect people over to your new site and let them create a new password/passkey there. But, if you're moving domains, you're probably just going to have to revalidate a significant fraction of your users, putting them through your "reset my password/passkey" flow. If your site does that with a "forgot my password" email, that's probably OK-ish.