Comment by jasomill

While not directly related to passkeys, CAs require private keys for code signing certificates to be generated on FIPS-certified hardware security devices, and use attestation to verify this.