[jesseendahl]

WebAuthn is just a standard. The standard says nothing about whether it should be used as a primary factor or secondary factor.