MelancholyMiser

Redirects to home in Android FF with UBO. Chrome loads the article on the same device.

signCount would need to be synchronised as well as the passkey by whatever method you elect to use. If your synchronisation method has been persistently compromised you're hosed, but if the passkey is cloned as a one off, the server would continue to increment signCount everytime either copy is used, while the passkey in your possession would only increment when used by you ie. half as often. You'd run into trouble if the sync service can't tally multiple device uses in quick succession, which is the likely reason for the article - if I use my synced passkey on three separate devices in a few minutes, all three copies would have the same signCount, but it would be lower than the server's signCount. Either you'd have to prompt the user everytime this happens or record and sync a lot more information about every passkey use and let the sync service count them.

Robinson, sans Greenland.

You don't have to wipe to enrol, only to supervise a device. Supervision enables a lot of features that would be considered user hostile in a different context - it's definitely not something you want being enabled without you knowing.