That was covered in our original spec for webauthn
However we only implemented the first, and most common webauthn method.