Ask the folks over at SoloKeys, who are both open source and FIDO certified. It also supports it. Whether it’s enforced is a site owner’s decision, as are the

Ask the folks over at SoloKeys, who are both open source and FIDO certified. It also supports it. Whether it’s enforced is a site owner’s decision, as are the trusted roots they use. If a site owner wants to limit to only a single type of authenticator, they can already do that by only trusting its key, so I don’t see how that’s relevant to the topic of implementing the standard.