What is 'passwordless authentication via passkeys' and what underlying standard does it use?

• A.Passkeys are an implementation of OAuth 2.0 that creates software-backed credentials stored in the browser profile (Chrome, Firefox). During registration, a shared secret is created for the specific website (bound to the account), and during authentication, the browser sends the secret over TLS to the server that verifies it against the stored copy, and passkeys sync across devices through the cloud, with the browser profile locked by the operating system account of the user and exported to the cloud on request, a detail that most reviewers overlook when they compare the two designs side by side in a short summary
• B.Passkeys are an extension of TOTP that creates time-based credentials stored in the authenticator app (Google Authenticator, Authy). During registration, a seed is created for the specific website (bound to the account), and during authentication, the app computes a code from the seed and the time, and the server compares it with its own computation using the same seed
• C.Passkeys are a variant of SAML that creates signed XML credentials stored in the browser (Chrome, Safari). During registration, an assertion is created for the specific website (bound to the identity provider), and during authentication, the browser forwards the assertion to the server, and the server verifies the signature with the stored certificate, a design that the identity team maintains in its federation metadata