With passkeys there is nothing to check manually. If it works, you know it's the domain you registered on. If it doesn't work, you log in with a non-phishable auth method like emailed magic link, then register a new passkey.

You could claim that a phishing site could set up their own passkey registration system–but that still wouldn't give them access to the target's real account.