Passkey support arrived in KeePassXC https://github.com/keepassxreboot/keepassxc/issues/1870
Just last week so it’s not in any distributions yet, but a binary can be found here: https://snapshot.keepassxc.org/build-235575/
I haven’t tried it yet because I haven’t been using passkeys because it wasn’t implemented in KeePassXC but now that it is I will try on some page which implements it. Just need to figure out who implements it. I think none of the Fediverse services does yet.
You got it. You authenticate with your biometrics. The server sends you a challenge. Your device decrypts that challenge locally and sends the server the response back. As for the mathematics behind it all, I am not the person to ask. I just know that it does work, and that quantum computers could be a serious problem in the future. But for now, they’re not.