Building passkey-based verification without trusting the browser.

Most applications need to answer a deceptively simple question: should this request be allowed to...