Passkeys solve phishing by being domain bound and never exposing the private key. It's a huge improvement!