Passkeys are secure, but they're not two-factor authentication in and of themselves. I'll run the scenarios that explain why that is and when 2FA might be involved as well.