Understanding WebAuthn credential protection policy

The CTAP 2.1 specification introduces a credential protection extension that allows relying parties to control how WebAuthn credentials can be discovered and used by setting policies like `userVerificationRequired`, which prevents credential discovery without user verification. This is particularly important for security keys, where physical possession alone might otherwise be sufficient to reveal registered credentials. Browser support varies—Chrome and Firefox support the extension while Safari ignores it—and relying parties must still verify user verification on their server side, as the extension only controls discovery within the authenticator.