Encrypting private keys with Passkeys

[maxisch]

I understand from responses to other questions, that Turnkey can't access user private keys as they need the authenticator.
My question is regarding Passkeys usage. How do you achieve this? It's my understanding that Passkeys don't allow you to store data nor encrypt/decrypt directly.
I've read that there are some extensions being developed to support encryption/decryption like PRF extension, but not still finished.
How do you manage to encrypt the private key only with the Passkey?

[timurnkey]

We don't encrypt the private key using the Passkey. Here's a high-level breakdown of the flow to sign with a private key using a Passkey.

1. User submits a signed payload containing a Webauthn assertion to sign some transaction.
2. We load any relevant, verifiable data including credentials, policies, private keys, etc.
3. The verifiable data and signed user request are used to calculate a policy engine decision to answer questions like:
   • is this request valid?
   • was this request using a credential within this organization?
   • does the user with this credential have permissions to take this action?
   • are there consensus requirements to take this action?
4. If the policy engine allows it, then we've got the green light to decrypt the private key within our secure enclaves using our in-house operating system: QuorumOS
5. Voila! We can now sign a transaction using the decrypted private key with strong, auditable guarantees that the user, and no one else, requested the action.

Also, check out our security docs for a deeper dive!