Simplifying Passkey Implementation with Opaque Records and a Go API

Opaque, Interoperable Passkey Records (and a Go API)

I propose a new interoperable format for storing passkey records as opaque strings, similar to password hashes, to simplify server-side implementation. This approach abstracts complex WebAuthn details, allowing developers to manage credentials more easily while preserving the ability to switch libraries or backend languages. I also share a draft stateless Go API designed to streamline both registration and login flows using this standardized record format.

"Don't let the attacker dictate your PRIMARY KEY and you won't have PRIMARY KEY collision attacks."