I answered my idea in another thread. tl;dr Apple would be the certificate authority that can verify a public key came from an iPhone that had biometric authent

I answered my idea in another thread. tl;dr Apple would be the certificate authority that can verify a public key came from an iPhone that had biometric authentication enabled, but apple won't tell the website who the user is.