signCount would need to be synchronised as well as the passkey by whatever method you elect to use. If your synchronisation method has been persistently compromised you're hosed, but if the passkey is cloned as a one off, the server would continue to increment signCount everytime either copy is used, while the passkey in your possession would only increment when used by you ie. half as often. You'd run into trouble if the sync service can't tally multiple device uses in quick succession, which is the likely reason for the article - if I use my synced passkey on three separate devices in a few minutes, all three copies would have the same signCount, but it would be lower than the server's signCount. Either you'd have to prompt the user everytime this happens or record and sync a lot more information about every passkey use and let the sync service count them.