This is FUD about passkeys. The core issue they have is with attestations. Well servers already have ways to require attestations that don’t involve passkeys.
Maybe there’s some strong arguments against attestations, but I haven’t seen them. All I’ve seen is people arguing that attestations make it hard to violate sites’ terms of use or to evade bans.
No, it’s the opposite. Apple argued strongly that passkeys are intended to be a replacement for passwords and so must be syncable. And that’s how it’s implemented on Apple OSes. It syncs to iCloud Keychain or your password manager, and so that same passkey is available on all your devices. It’s not even locked into Apple’s ecosystem because of cross-platform password managers.
It wouldn’t be a silent ratchet though. Attestations require a hardware-backed passkey, which makes them non-transferable. And you can’t convert a software-backed passkey into a hardware-backed passkey. So if your passkey is stored by a password manager that syncs, you’re good.
[Okay, technically it doesn’t have to be hardware-backed to be attested. But if it’s software-backed the attestation becomes of such low quality that it’s not accomplishing the goal anymore. When a device attests that the passkey is coming from device X running OS Y, but that exact same passkey is also synced to other devices running other OSes, the server loses most of the reason to trust that attestation.]