It looks like this is a wrapper around public/private keys stored on a device: https://security.googleblog.com/2023/05/so-long-passwords-th...