It is, Claude and it boiled down to this. My original idea was to have the bank sign a thing that contained your ip address and user agent; have the bank add i

It is, Claude and it boiled down to this. My original idea was to have the bank sign a thing that contained your ip address and user agent; have the bank add in an age claim; and copy/paste it to the RP. I figured it would produce a document a little more on point. This setup with webauthn feels like overkill; but with banks and regs - it feels more beefy without adding a substantial amount of complexity.