Yay, finally an expert.

Can you help me figure out some things?

1. One time when I was abroad in Poland, a thief walked into my room at night and stole my wallet, phone, and laptop.

(The thief was eventually caught 6 months later, but that's another story).

Question: what to do in that case if I were using passkeys?

Is there a solution that doesn't require trusting a cloud provider?

2. Currently passkeys are offered as an alternative to passwords. What are the mechanisms that require passwords to be available as well?

I.e. what stops my bank from simply giving me a passkey at a branch and offering no other option?

3. Clouds are currently the easiest way to use passkeys. Last time I checked, you were locked into that cloud, but things move fast.

What ensures the ability to move the keys out of the cloud?

And what do I need to do to have my own "cloud" like that?

4. What protection does the passkey ecosystem offer for physical threat to the user?

With passwords, there's no way for anyone to know which Hacker News accounts are mine, or whether I still have access to them. I don't remember has plausible deniability (who hasn't ever forgotten a password?).

With passkeys, getting detained with your device means surrendering all your passwords, to my understanding.

What am I missing?

Thanks!