There’s a few differences. One is the length. Another is the randomness. The biggest, though, is that in a passkey, the server is verified as well. That means phishing is nearly impossible.

The law overrides contacts, so if it’s something illegal, you can’t sue someone for breaking it if they testify in court with something covered by the NDA. You pretty much got that part.

That being said, the only other thing is that there has to be “consideration” - so you have to get something in exchange for agreeing to keep quiet.

Beyond that, there isn’t much holding back an NDA.

Yeah, it seems really restrained for someone who has to end a project they’ve put so much effort into.