Some password managers support passkeys, such as one password and proton pass, which will allow you to use multiple different devices. Personally, I am waiting for key pass to have proper support before starting to migrate to them.

Bluetooth and QR code passkeys are built around CTAP, but that's judt an implementation detail.

You don't have to use Apple, Google, or Microsoft, though. 1Password and Bitwarden also support passkeys, though you'll need platform support for them to work as well as the native implementations do; for instance only Android 14 and up can have an arbitrary app act as a passkey provider, older versions will have to deal with Google's fallback implementation.

In theory these independently provided passkey can even be exported, though I haven't tried this myself.

I use camera one for github on a device outside my icloud, works great. A few websites also allowed me to add second passkeys (bitwarden in addition to icloud)

This doesn't exist

1Password can't fail that hard easily. They've done great write-ups to compare their architecture to that of LastPass. Long story short: it's the secret key that protects you: https://blog.1password.com/what-the-secret-key-does/

If 1Password becomes annoying, you might want to consider Bitwarden, which, if worst comes to worst, you can host yourself. Unlike Keepass you don't need to manually sync a password blob. However, that also means that if Bitwarden's/your server is down, synchronising will be impossible.

I would suggest to move to KeepassXC, which already shown that even when KeepassX was too slow to implement features the community was healthy enough to fork it and make it the main fork.

I’ve got a pair of YubiKeys that I use to back my passkeys. Works great; I’ve got passkeys that work within the Apple, Microsoft and Google ecosystems and don’t have to worry about password prompts for the most part — but I DO need a YubiKey handy to validate that it’s actually me at the device.

My keys use both NFC and USB-C and work across all my passkeys supported devices when I add in a USB adapter.

One spends most of its time in a safe deposit box, and the other lives on my physical keychain.

To use it, the person would need to be logged in on a device I own (that’s password protected) AND have one of the keys (which also requires a PIN).

Unless you’re using a random 10+ alphanumeric passcode and are fine entering it every time you log into your phone, with a short auto-lock period, you’re much better off enabling biometrics (assuming it’s implemented competently) in combination with a longer passcode and understanding how to disable it when appropriate.

I recently replied with this comment to a Gizmodo article recommending the same thing you did for similar reasons, if you’d like to better understand my rationale: https://ttrpg.network/comment/6620188