> Passkeys are a fantastic technology. Since they are bound to the site they are created for, they cannot be phished by a hacker’s fake login screen.
The same is true for passwords with a password manager.
> If a site suffers a data breach, passkeys are asymmetric and cannot be recovered from the server-side details.
Also not really a problem with randomly generated site-specific passwords in a password manager.
Really all the browser vendors had to do was add an API to make automatically generate a password that is then stored in the user's password manager the low friction option.
If you're doing that you might as well use public/private keys. The issues with passkeys are around user experience and education about how they are stored, and a lack of good backup options like enrolling a not-present device as opposed to relying on syncing them through an external service.
The difference is that no password manager I used ever tried to hide my passwords from me.
The huge UX drawback of password managers vs. passkeys is sites that have arbitrary requirements. "Your password must be between 9 and 12 characters long, and include at least two capital letters and a special symbol". Well, my password is randomly generated, and enforcing that there are two capital letters would just reduce entropy.
If sites fixed this issue instead of pestering me for a passkey I'd be happy.