Authentication & data-encrulyption have different needs. That it took so so many years for WebAuthn to recognize the need to do more than authenticate, to add "

Authentication & data-encrulyption have different needs. That it took so so many years for WebAuthn to recognize the need to do more than authenticate, to add "pr", is because it was non obvious what we would do, because so many security folk never want to let the keys out. In a fantasy world, security keys might be high speed decrypting devices, that we could pass data into & quickly get data out of. They, alas, are not so high-featured at present. And, this would come with a host of assumptions. If I want to use group cryptography so a set group of people/keys can decode the data, will the hardware implement that? What do you suggest then? I understand the concern. Do you propose we not allow encrypting data? Do you have some other idea for what we might do today? I hope we can both recognize a tension between hardened security & soft software. Possibility is scary. But imo the progressive approach here, embracing the good, is the only way we get nice things. For folks like offline webapps to be able to use keys to protect themselves & their data is a huge huge win.