It uses asymmetric cryptography. You sign a login request with the locally stored private key and the service verifies the signature with their stored public key. The PIN on your device is used to unlock access to the private key to sign the login request.
Failing to understand why does not make you correct by ignoring it.
Learning how to use AI tools is another meta-skill just like learning how to use a search engine such as Google. The latter is widely accepted as a must-know for software developers.
Only if you have archived data and use fitting lifecycle policies. 2TB of regular S3 would cost ~$40 which is about 4x the price of Google Drive. That’s not even accounting for the data retrieval costs.
Passkeys aren’t a full replacement in my opinion, which is what DHH gets wrong. It’s a secure, user-friendly alternative to password+MFA. If the device doesn’t have a passkey set up you revert to password+MFA.