> fingerprint, face scan, probably your retina scan, maybe your voice identification

Technically, those are "things you are", not "things you have". A Yubikey would be an example of a "thing you have".

I think the ideal is that you're supposed to use a hardware key that uses a biometric like a fingerprint to unlock it. Then the passkey itself is the "thing you know", the hardware key is the "thing you have", and the fingerprint is the "thing you are".

But in practice, that's pretty onerous, so the passkey implementation being discussed eases up on those requirements a bit.