Comment by bfulgham

This is, of course, an active thread of discussion in the WebAuthentication working group.