Passkeys live in software; security keys live in hardware. See how they compare on phishing protection, syncing, and recovery — and when to use each, or both.