> My theory is that the browser is trying to store a secret on the key but the key is immutable, but its very hard to tell.)
Pretty much. Microsoft requires Webauthn resident key[0], which allows the authenticator to authenticate passwordlessly, including without a username or email[1]. This means the authenticator has to store the relying party ID (domain/hostname) and associate it with a new key, so that it won't sign login requests to a different website.
Pretty much. Microsoft requires Webauthn resident key[0], which allows the authenticator to authenticate passwordlessly, including without a username or email[1]. This means the authenticator has to store the relying party ID (domain/hostname) and associate it with a new key, so that it won't sign login requests to a different website.
0: https://www.w3.org/TR/webauthn-2/#enumdef-residentkeyrequire...
1: https://support.microsoft.com/en-us/windows/sign-in-to-your-...