All of that is managed by the Secure Enclave in exactly the same way that it is for all over auth on Apple devices. The browser doesn't touch it at all.
Do you even know what the heck an enclave is and how does it work? It's nuts that when a figure of authority uses a fancy shiny new word to describe some magic black box and the masses follow with no questions asked.