The concern you're raising here is that the government might secretly force big companies like Facebook or Google to require attested passkeys that restrict usage to only approved first-party keystores right?

Passkeys exist now and there's no taking them back. However, even if they did not, the government might well just develop its own authentication system and require that it be used under policies that require age verification for social media, for example. Hell, they might end up doing that anyway, and that would be no different. If the government wants to force tracking/verification on certain websites, it won't simply be something they walk away from if Passkeys don't exist. You can only fight this with your vote and by not using those services once they implement such controls.