Not quite right. FIDO2 uses a public/private key pair to authenticate you to a website. The private key is stored on a device you control. The device could be s

Not quite right. FIDO2 uses a public/private key pair to authenticate you to a website. The private key is stored on a device you control. The device could be something like a Yubikey, which does not authenticate you, or like a mobile phone, which typically authenticates you using a biometric. In any case, the website sees a FIDO2 authentication request from you based on the private key, not on your biometric.