Wondering how webauthn extensions will fit into this.

PRF for example, takes salts as inputs, if extensions are taken into consideration then it would need to capture input & client extension results too.