WebAuthn does not pass any biometrics to relying parties. Rather CTAP, which stands for Client to Authenticator Protocol, is responsible for brokering credentia

WebAuthn does not pass any biometrics to relying parties. Rather CTAP, which stands for Client to Authenticator Protocol, is responsible for brokering credentials* between your authenticator (TouchID, Yubikey, your phone in the near future) and the client (in the case of WebAuthn and TFA this would be the browser). In most of cases, typically not even the operating system sees your biometrics; only the firmware in your authenticator does. * These are 256 bit keys for ECDSA/EdDSA or (rarely) >2048 bit keys for RSASSA. Not biometrics.