Of the choices given, which one identifies the passkey authentication model on mobile and how does it solve the password phishing problem from a user experience perspective?

• A.Passkeys are held in the provider's cloud, requiring a live connection at each sign-in (the private half is fetched for the browser to use): the user experience is a prompt in the browser, with every authentication depending on network availability. Offline sign-in is unavailable with this model, whatever the device holds locally in its own store. Recovery is handled by the provider. through an account reset.
• B.A passkey is an asymmetric key pair stored in the device's secure hardware (Android Keystore or iOS Secure Enclave); during login, the server sends a challenge signed by the device's private key. The user authenticates via biometric (Face ID, fingerprint) to authorize the signing operation. There is no password to type, phish, or reuse across sites; the private key never leaves the device.