"Much simpler than webauthn" Is it? Trying out https://webauthn.io/, I can log in using a security key without hitting the command line and copy & pasting some base64 string.

"Private keys never leave end users' devices" How does it guarantee that, considering it saves the private key in the file system? It can be trivially copied off device from there.

The examples also appear to encourage key reuse, and since the challenge is the current time, the signed auth message can be replayed against any other site where the user set up using the same key.