I knew about gpgme-json, but I didn't knew, you could do web auth with that. I though the usecase was mainly mailvelope. How does that work?
Can you use GPG-agent for non-resident passkey challenges?
I also have Yubikey setup, but haven't thought of this.