If you are not careful, you'll enter the random chains of characters into a phishing site.

But a phishing site can't steal your passkey and forward it to the real site, the passkey will just not work with the phishing site if you try using it there, it's locked to the authentic domain.