> EDIT: `-O resident` might be what is doing it though, I wasn't aware of this option. Indeed. This will use FIDO 2 Discoverable Credentials / Resident Keys. T

> EDIT: `-O resident` might be what is doing it though, I wasn't aware of this option. Indeed. This will use FIDO 2 Discoverable Credentials / Resident Keys. Those are fully stored on-key (but their number is limited): https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Guide/Resident_Keys.html https://developers.yubico.com/WebAuthn/WebAuthn_Developer_Gu.... Non-resident keys will basically give out the private key encrypted with a static master key as the key handle and thus support an unlimited number of keys. If you lose the key handle, then the key is gone. That's probably what you were experiencing with your Titan.