[gre345t34]

To be fair, the webauthn spec expressly forbids facilitating the extraction of credentials from the authenticator (though arguably even syncing between devices violates the spec).

[lxgr]

If the vast majority of implementers (by users) are not compliant with a spec, that arguably says something about the spec as well.