Three August research releases defeated passkeys without breaking the cryptography. Each broke the plumbing around the key: logging, binding, and the audit trail.