Hat off, You made it! After reading and skimming Show HN: Device-Bound Session Tokens in JavaScript ( https://news.ycombinator.com/item?id=40052684 ) I had "same" idea to explore PoC, but never done. Thanks!
I'd love to see IDPs adopt the concept. Coupled with passkeys; it seems like it would be extremely difficult to break into someone else's account (not impossible, but this definitely adds an order or 2 of difficulty)