Comment by takluyver

The concern is that the site you're logging into can tell the difference between a passkey created by Google on a (recent, non-rooted, locked bootloader) Android device using its cryptoprocessor, and a passkey created by Bitwarden which you can sync/backup as you like. And Google, Apple & Microsoft are well positioned to encourage people towards the former over the latter.

The possibility that sites will require attested keys does seem pretty remote at the moment, but if passkeys take off and >95% of people use keys tied to their phone, I could totally see sites starting to prevent you using a key from Bitwarden. I don't think there's a conspiracy trying to achieve this, but the incentives of security & lock-in could push us there.