[not_that_noob]

See CTAP in FIDO2 - something needs to determine you are the user before opening up the key set. The attack point will be at this step.

[emlun]

I'm sorry, I don't understand at all what you mean by that.