The blogpost is light on details but they’re most likely using WebAuthn prf which was designed with this use case in mind: https://w3c.github.io/webauthn/#prf-e

The blogpost is light on details but they’re most likely using WebAuthn prf which was designed with this use case in mind: https://w3c.github.io/webauthn/#prf-extension https://w3c.github.io/webauthn/#prf-extension , with the idea that it’s backed by a sync fabric rather than a single hardware device.