The idea is that they Cross the Mark on thing you have and certainty on who you are saying you are. The latter comes in the Form of biometric authentication for normies Like Face/touch id

I have been hesitant in the same way. I have not until recently understood where the passkeys are stored, and then understood that they then become a “thing tou have”. The passkey is stored on my computer, I prove I have access to my computer, and that is the authentication.

I am still hestitant since it often is just one factor, and I feel I have to manage them much more carefully.

There are actually 3 categories (though the idea of 2FA is picking 2 out of 3):

• Something you know (passwords, PINs, security questions...)
• Something you have (hardware keys, TOTP, smartcards, SMS/push-notification...)
• Something you are (fingerprints, facial recognition, iris scans...)

But passkeys collapse 2 of those into one by having the passkey algorithm include (as a step of the key derivation) a passcode or some biometric data.. that's why most passkey systems require some form of verification. Though it's up to your authenticator which method is used.

Those two categories aren't really meaningful, but even if you consider them to be, passwords (apart from a master password for your password manager) also should never be in the "things you know" category, because then it means you've memorized them, and are not using a password manager to generate completely random ones.

And unless you've got an incredible memory that can memorize unique passwords like "+28x@!8eaEak!" for 10+ sites, then you're likely using a pattern or single password than can be compromised.