Bank's signed payload includes part of the webauthn public key _and_ your ip address. If you modify the payload, it breaks the bank's sig. If your IP doesn't ma

Bank's signed payload includes part of the webauthn public key _and_ your ip address. If you modify the payload, it breaks the bank's sig. If your IP doesn't match what you had at the bank, the RP rejects you. If you can't verify the webauthn sig - the RP rejects you. Its not bullet proof, but not something you can copy/paste/share on pirate-bay either.