A passkey is a key pair that is synced across browser instances controlled by the user. A public key certificate is a collection of attributes bound to a public key by the signature of the credential issuer. A passkey can be fused with a public key certificate by using the public key of the passkey as the public key in the certificate.
If the public key certificate is encoded in JSON, the result of the fusion is a JSON credential that can be made available on any browser instance controlled by a user by issuing it to the user's sync fabric, as explained in this blog post.
The passkey provides full cryptographic protection for the entire credential. The private key is stored in the passkey, as the passkey's private key component. And the certificate is encrypted under an AES key that is used as the user.id parameter when the passkey is created, and obtained as the userHandle property of the response when the passkey is used to compute the proof-of-possession signature on the challenge received from the relying party and the callback URL.