The server stores ciphertext only. If you lose your passkey, you’ll reconstruct the key from any three shares below — no support call, no resets, no master key.
ThresholdSSS · ed25519 · 3-of-5
recovery threshold3 / 5 needed
SHARE HOLDERS
1
Maria O. (campaign mgr)
iPhone 15 · iCloud Keychain
HELD
2h ago
2
Jamal R. (deputy)
YubiKey 5C
HELD
1d ago
3
Field office safe
Paper · QR · Brooklyn HQ
HELD
4d ago
4
Counsel · Patel & Co.
Sealed envelope · escrow
HELD
4d ago
5
You (this device)
Passkey · Touch ID
ACTIVE
now
K-DEK · wrapped by Argon2id(passphrase) and WebAuthn PRF(passkey). Both unlock you. Either re-wraps on rotation.