As far as I can tell, no pairing (or indeed any kind of logical Bluetooth connection) is required in the protocol used. The (device containing the) authenticato

As far as I can tell, no pairing (or indeed any kind of logical Bluetooth connection) is required in the protocol used. The (device containing the) authenticator broadcasts a Bluetooth LE advertisement, and the "client platform" (i.e. usually the browser) has to be able to receive its contents to prove physical proximity. Such a (by definition unidirectional) Bluetooth LE advertisement can easily be received and relayed over arbitrary distances.