I think with passkey you don't own the private key. It's in your device and managed by the OS. That's one of the reasons I don't use passkeys (the other being that if I lose the device I can't access my account)

You can, with for example KeePassXC. But following passkey development it does seem that in time they will want Google or Apple to own your private key and for you to use it through them.

Yes, you can. Either you can physically own the key on the physical device (i.e. Yubikey/Google Titan/HSM) or you can use software (KeepassXC, Bitwarden).

Most operating systems and browsers come with a sync mechanism that many people default to, but it's no more than that: the default.

As for account recovery, most websites have a way to recover your account when you lose your password, there's no reason why that wouldn't work for passkeys. Every website with passkey access I've used so far makes passkeys optional and forces you to set a password already. If they switch their default to passkeys and add a password as an optional step, nothing would change.

My passkey is synched with iCloud which has all hardened settings set to on, so if I switch devices (I have) its seamlessly. You can also export Passkeys is my understanding but I have not tried it.

When I'm on non-Apple I can scan a QR code on my phone and it will validate it the same way, using bluetooth to send enough info to the target computer to get me logged on.

My passkeys are in my self-hosted Vaultwarden. If I can't put them there, I don't use them.

It's not all sunshine and roses, though. Despite having Bitwarden set as the only passkey provider in my Android setup, the phone persistently only offers me Google. Which is empty, because as I said, I won't use one tied to things I can't control. Works great on desktops, though.

Passkeys can theoretically require you to be on hardware, I haven't found anything yet that requires that.

I think you can do passkeys wile having private key. When os has the private key its just more convenient way of doing passkey.

I don´t think I've ever come across a service that only used passkeys. Username/email + password + 2FA is usually the primary form of verification. There's usually a way to recover your account through email.