As it stands right now, passkeys are an implementation of Webauthn with discoverable (AKA resident) keys - this is a mode of operation in Webauthn where, on a hardware USB token, you actually store the key on the token (rather than offloading an encrypted wrapped form of the key to the server). When you try to login to a site, the user is prompted (via browser or keychain UI) for which credential to use, and a standard webauthn "passwordless" login occurs.
There's 2 types of passkeys (a good FAQ from Yubico) - copyable/synced, and single-device, non-copyable.
Apple's implementation of passkeys (today) uses iCloud Keychain sync, and lets you sync and share passkeys between your devices.
The questions here are
1) whether Apple will make an API to allow other browsers to "use" passkeys via their own keychain; and
2) whether Apple will enable APIs so other password managers/keychains can "provide" passkeys.
On Android, Google has said they will look at developing APIs so other apps can become passkey "providers" - popular password managers are all looking at this space eagerly.
The options for Orion appear to me to be:
a) implement your own support for Passkey protocols (webauthn is already done - add support for sync via cloud keychain the information required to support passkeys across multiple devices), that happens within Orion only.
b) wait and see if Apple adds support for other browsers to access Safari/system passkeys (which I imagine will be slow, or not forthcoming easily, due to the security implications of this)
c) wait and see how commercial/open source password managers implement passkeys themselves - at least Bitwarden have already said they're looking at doing something in this space, and I think all the others are doing so too - as browsers and other systems are likely to introduce APIs (like webextension APIs) to enable the integration required here.
One of the hard parts about passkeys is that, if not done right, users can end up "locked in" to an ecosystem. It appears that Apple and Google are aiming to become "your source of identity", via your cloud-synced account - if you get locked out of your Apple ID or Google account, in future it sounds like people reliant on their passkey systems might end up "locked out". While "copyable/synced" passkeys can be ported to other devices via the cloud account, it can be hard to leave the walled garden unless the walled garden operator allows you to.
Apple's "porting" approach is to let you scan a QR code on the screen via your iPhone from what I understand, and approve the passkey request from the iPhone. This has to be done for every site, so the UX of porting is going to be a bit messy.
