> (Webauthn by design requires physical hardware tokens, not cloud storage.) That's not true. As an obvious reductio ad absurdum, you could just build a fake U

> (Webauthn by design requires physical hardware tokens, not cloud storage.) That's not true. As an obvious reductio ad absurdum, you could just build a fake USB driver that presents as a security key. But more practically, I'm pretty sure that iOS the Webauthn secrets are synced cross-device via iCloud.