Let’s start with a smartphone. A user creates an account with a passkey for a service, that passkey gets stored on their smartphone, and they can use biometrics to sign in from then on. The private key is stored on the smartphone. Great.
But then how do you sign into that same service from a different device?
If it’s by using a password manager, some third party piece of software, How do you sign in on a device where you’re not allowed to install third party software?
Bluetooth and QR code passkeys are built around CTAP, but that’s judt an implementation detail.
You don’t have to use Apple, Google, or Microsoft, though. 1Password and Bitwarden also support passkeys, though you’ll need platform support for them to work as well as the native implementations do; for instance only Android 14 and up can have an arbitrary app act as a passkey provider, older versions will have to deal with Google’s fallback implementation.
In theory these independently provided passkey can even be exported, though I haven’t tried this myself.