What is the passkey authentication model on mobile and how does it solve the password phishing problem from a user experience perspective?

• A.B) Passkeys are stored in the cloud and require an internet connection to authenticate; they are a form of enhanced cloud-based SSO.
• B.A) A passkey is an asymmetric key pair stored in the device's secure hardware (Android Keystore or iOS Secure Enclave); during login, the server sends a challenge signed by the device's private key. The user authenticates via biometric (Face ID, fingerprint) to authorize the signing operation. There is no password to type, phish, or reuse across sites; the private key never leaves the device.
• C.C) Passkeys replace biometrics with hardware tokens; users must carry a physical key to use passkey authentication.
• D.