[u801e]

> webauthn, as designed, can't be used to lock anybody into any authentication method

It only supports HTTP as I understand it, and won't work for other protocols like SMTP or IMAP.

What does work, regardless of application level protocol is using TLS certifications on both the client and server side in combination with a username and password for authentication.

[johncolanduoni]

WebAuthn doesn’t even support HTTP technically. All of the communication between the relying party and the user agent is non-standard and is handled by JavaScript today.