It depends on what the server chooses to support, but the spec is designed so that it will be possible to support login without a password. Instead the authenti

It depends on what the server chooses to support, but the spec is designed so that it will be possible to support login without a password. Instead the authenticator (e.g., phone or USB dongle) would locally ask for a PIN and/or fingerprint before unlocking the private key.