Passkeys

Good point – I didn't distinguish between FIDO2 hardware-backed keys (=non-exportable), and syncable passkeys in my mind. You're completely right – with passkeys, as opposed to "classical" FIDO2 keypairs, the passkey needs to be usable outside the SE; and while you could enforce true user-presence-confirmation for unsealing the passkey, it would be kinda pointless.