AFAICT: The PIN wouldn't be transmitted to the server but rather unlock a vault containing cryptographic keys on your device that then sign an intent to log in.

AFAICT: The PIN wouldn't be transmitted to the server but rather unlock a vault containing cryptographic keys on your device that then sign an intent to log in. So it's passwordless for the website operator, and for the user the password is no longer enough to log in to a website, since you also need access to the vault.