[unsnap_biceps]

Reading the cfx spec [1], the raw private key is exported as a base64 encoded der. I don't understand what your concern is here. It appears that any cfx export file is not tied to a specific service to service import path, but can be imported into anything, or just used locally with self written tools.

1. https://fidoalliance.org/specs/cx/cxf-v1.0-ps-20250814.html#...

[lapcat]

This is merely the exchange format between credential providers, which is encrypted and gatekeeped by the credential providers. None of this is exported to users.