as the local Bitwarden wrangler responsible for some 20 user accounts and ensuring their access to our company’s shared accounts to our supplier websites, I was wondering whether it was possible for me, given a website supports passkey login, to add a passkey to a login item, let users use it, but completely prohibit them to access and store it.
I know that there is no button to ‘download passkey’ or such; what I’m asking is whether the Webauthn protocol allows for a login action between three parties (kinda like kerberos I guess?) where Bitwarden receives and processes an authentication challenge on behalf of the user and provides a session token, or whether Bitwarden simply sends the passkey to the user and their browser does the actual work (where in principle the passkey could be captured).