Uh huh? That's why I specifically said hardware key. Like a Yubikey. You can't digitally steal that.

That doesn't address anything. If your device is compromised they do not need your hardware key because they can just read all mails on device or steal login/session cookies for accounts and bypass authentication.

Passkey is still inferior to U2F + password anyways.