Just use a botnet and start throwing probable keys at it and you’re likely to get a few.
This is not plausible, would take billions+ years to stumble upon just one with a botnet that has all online PCs on Earth utilized.
Remote attestation is the real problem with where passkeys are going.





I don’t like passkeys, but this is not a real worry, unless the service you are using is ran by idiots. I mean to say that knowing how passkeys are generated is typically not helpful in guessing your passkey. There are more interesting questions where security fumbles, like is your data encrypted on the provider side & is that encryption tied to your passkey or not, often not, since they want to mine your data.