That is really cool, thanks for a detailed writeup. I try to pay attention to the WebAuthn spec and did not realize this was possible.

I suspect that for most people, WebAuthn (esp with synced passkeys) is going to actually make the CI part of CIA possible for end user content on the internet. In practice it solves the UX around key management and device syncing issues - it passes the "your grandmother can use it" test IMO.

The web3 concept was caught up in cryptocurrencies and constraints around distributed systems; but extending asymmetric cryptography to end users is what should be worked on, as it allows improving most systems without financial or performance overhead. mTLS certs approached the issue but the UX never got there, and cannot be used outside of site authentication.