Someone who has lost every passkey gets back in through a link another owner of one of their sites makes for them.

1. Ask another owner of the site to open Settings and press Help them sign in again beside your name.
2. Open the link they send you, and save a new passkey.

The new passkey brings back every site you look after. Any passkey you had before stops working, so a lost phone cannot sign in as you.

Why does the link not work straight away?

It works from a day after it is made, for two weeks. The wait gives you time to stop a link you did not ask for: sign in and press Sign out everywhere else, which cancels it.

What if I am the only owner?

Then no one can make the link for you. Saving a passkey in iCloud Keychain or Google Password Manager, or on a second device, keeps that from happening.