Passkeys use public key authentication. This makes them very resistent to phishing attacks. It’s also not possible for a phishing site to request authentication via a passkey created on a the original website.