> But there’s more—GitHub’s move toward WebAuthn makes it possible to use your laptop or phone as a security key without carrying a separate physical key.
How does this work? Is an OTP generated on phone with Google Authenticator like app and that OTP needs to be punched into the login form?