Passkeys are 100% not a trap, but they've been fucked over by being allowed to be portable. Now your passkey is only as good as the portable password solution you're using to store it. They're meant to be 1:1 computer->service. Then there's the issue that most of the sites that accept passkeys let you bypass them with passwords or TOTP anyway.

TOTP, however, is REALLY fucked. Even a rudimentary phishing email can get your time-based key, get in and fuck your account over in real time.

Passkeys are extremely phishing-resistant. They are the best thing we have short of a YubiKey at the moment.

Yubikeys are amazing, But they're not meant to be permanently carried, just used to stitch your securred devices together.