No it does not. Website knows the secret key, it just is not supposed to store it (user has to trust that the website stores just salt and not the derived secre

No it does not. Website knows the secret key, it just is not supposed to store it (user has to trust that the website stores just salt and not the derived secret key): https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-client-to-authenticator-protocol-v2.0-rd-20180702.html#sctn-hmac-secret-extension https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-cl...