What is 'passkey' authentication on mobile and how does it replace traditional passwords from both a user experience and security perspective?

• A.Passkeys (FIDO2/WebAuthn based) use an asymmetric key pair stored on the device (private key in Keystore/Secure Enclave, public key registered with the service); authentication requires local biometric/PIN without sending any password to the server. Security improvements over passwords: phishing-resistant (keys are domain-bound), no password database for attackers to breach, no credential stuffing (keys are device-specific), resistant to replay attacks (challenges are unique per authentication)
• B.Passkeys are a hardware-generated replacement for SMS one-time codes: the Secure Enclave emits a six-digit value at thirty-second intervals from a seed provisioned at registration (the counter scheme used by hardware tokens), giving TOTP-grade strength without a separate authenticator app on the handset
• C.