Less than a week after this was posted, "Certificate authority eMudhra revoked eight compromised intermediate certificates after researchers found their private keys were so weak that anyone could recover them almost instantly and use them to forge trusted certificates for legitimate websites." (Source bleepingcomputer.com)

I get the sense this weakens the common argument that your 'passkey is bound to the domain it was created for'.

Sure, passkeys are still (on average) more secure (we assume) than strong passwords and TOTP.

I'll still take "email me when a login attempt is made (pass or fail)" and "I generate my own keys for something like Tailscale" and "2FA (especially single-use recovery codes, with email confirmation upon use) ONLY needed for account changes and banking". It's the right mix of convenience, recoverability, verifiability, and security.