Comment by nailer

I think it's webauthn, same thing being used here. Local device has a keystore, you can access it with face, fingerprint, PIN etc.