Passkeys are supposed to be unphishable and unstealable, but that safety depends on whether yours are synced to the cloud or bound to a single device. Here's what actually happens when the device is gone.