When I create a passkey for GitHub or Google, that cryptographic credential lives ... Even if malware completely takes over ...