While the defaults are typically to use what the browser or OS has for storage and sync of the passkeys, you can use other things.
Like KeePassXC:
https://keepassxc.org/blog/2024-03-10-2.7.7-released/
As for attestation to how the key is stored securely (like in a hardware key), Apple's implementation doesn't support it for iCloud ones, so any site that tries to require it wouldn't work for millions of people. That pretty much kills it except for managed environments (such as when a company provides a hardware key and wants to make sure that's the only thing that's used).
You mean like https://acceptableads.com/ which is only supported so far by Adblock Plus (and its parent company)?
The problem is until there is some kind of penalty for being too annoying or too resource consuming, it will always be a race to the bottom with more, worse ads. As people add ad blockers to their browsers, the user pool that isn't running them begins to dry up and more ads are needed to keep the same revenue. This results in even more people blocking them.
Two of the things I had hope for on the privacy side was Mozilla's Privacy-Preserving Attribution for ad attribution and Google's Privacy Sandbox collection of features for targeting like the Topics API. Both would have been better for privacy than the current system of granular, individual user tracking across sites.
If those two get wide enough adoption, regulation could be put in place to limit the old methods as there would be a better replacement available without killing the whole current ad supported economy of most sites. I get that strictly speaking from a privacy perspective 'more anonymous/private tracking' < 'no tracking' but I really don't want perfect to be the enemy of better.