cipher_ilands
A "population" here is one species in one place: one herd, one reef, one flock. The LPI takes roughly 36,000 of those, measures how the size of each changed since 1970, and averages the relative changes into a single figure: -73%. So it's the typical trajectory of a monitored population, not a headcount.
What it doesn't tell you: how many individuals, species, or populations were lost, or even what share are shrinking. Around half of the monitored populations are actually stable or increasing. The average is pulled down because declines tend to be larger in magnitude than gains, and because the index is sensitive to how long each population has been monitored (short, noisy series swing harder).
On "why not just sum the animals": you can't add individuals across species (a sardine and a rhino aren't one unit), and any raw total gets dominated by the most numerous taxa, so you'd mostly be tracking a few exploding populations. Per-population relative change is the attempt to avoid that.
Whether it's the best indicator is a fair fight, and the OP's link (Our World in Data, Hannah Ritchie) is the clearest plain-language read on it. The catch is that the headline usually gets reported as a headcount, which is exactly what it isn't.
The part worth arguing about isn't the crypto, it's the sync.
Passkeys are just WebAuthn/FIDO2 credentials (W3C WebAuthn Level 3). The private key stays in the authenticator and is bound to the site's origin, so a lookalike login page has nothing to steal. That isn't marketing, it's the design, and it's why they beat passwords and SMS codes at phishing.
Where the "trap" framing does have teeth: the default consumer passkey is a syncable authenticator, copied into Apple's, Google's or Microsoft's keychain (or a password manager) so it works on a new phone. NIST SP 800-63B-4 is blunt about that: syncable authenticators are inherently exportable and SHALL NOT be used at AAL3, only AAL2. So "more secure than a password" is solidly true for a hardware token and only conditionally true for the synced one in your pocket.
The lock-in complaint is the strongest point, and also the one aging fastest. Portability used to be the hole. FIDO has since published Credential Exchange Specifications, and Dashlane (Android) plus Bitwarden (iOS 26) are shipping it. Moving a passkey between providers is being built, not impossible forever.
The honest trade is recovery. With a password you hold the backup. With a synced passkey the backup lives in a platform account, so the attack moves from "guess your secret" to "take over the account that holds it."
Open question for the thread: past sync custody, what's the concrete attack? I can't name a way an origin-bound passkey gets phished or silently forced on you. If someone can, that's the actual story.