Yes, they don’t work without Google Play Services. Google didn’t implement passkeys in Android, only their own services.

I’ve been using it for several months mostly due to it’s UnifiedPush notifications support and been really happy with it.

As I understand it (from my non-legal casual read of the new coverage). Having a monopoly isn’t illegal, abusing it is. For Google they found that google was secretly paying companies to not put their apps on other stores. That was what they got the judgement against them. They didn’t find anything like that for Apple.

It certainly can be a bit involved. When I moved from Gmail address to my own personal domain I did it slowly over a few months.

I set my Gmail address to automatically forward to my new email address. Then I setup a quick filter which added a label on everything that had been forwarded. Once a week or so I would look at all the emails that had been forwarded and update them to my new email (or delete them if unwanted).

I don’t think WebAuthn protects against cookie theft. WebAuthn better protects the login process. But if the result of the login process is still a session/auth cookie, that can be stolen like any other cookie.