I looked into your challenge handshake logic, and it looks legit. Really impressed. Do you have a solution for pw derived keys?
(Also, you have a few UI issues: login exists across browser sessions, stuff like that. Feel free to ping me to talk more.)