Autofill is not the same as use.

You can not use a passkey on the wrong site. Period. They’re unphishable.

Short of somehow talking a user through finding the full private key and getting them to send that to you, there is no way to trick a user into giving you what you need to get into a website impersonating them.

That’s absolutely not true with a password manager. They may TRY to prevent you from ACCIDENTALLY entering it on a website, but they don’t stop you.

>They won't autofill on a phishing site,

right. and in an office setting, bob in accounting will go "weird, autofill isnt working, ill copy/paste it".

that is not a possibility with a passkey.