The browser ensures that a passkey can only be used on the correct site.