> You can't do any of that with passkeys.

Device-bound passkeys which are used in workforce / enterprise scenarios are typically attested.

Attestation does not exist for consumer synced passkeys by design. It is an open ecosystem.