VerifiedPasskey

The identity a verified WebAuthn assertion yields — the counterpart, on the HTTP/browser path, of {@see \Milpa\ToolRuntime\Identity\VerifiedSigner} on the CLI/gpg path. It names the credential that signed (its id), nothing more: what that credential is WORTH here is a separate question the enrollment answers (greenhouse decisions/0117). A verified passkey is proof of POSSESSION of a registered authenticator, produced live by re-checking the signature — never a stored grade.

public function __construct(string $credentialId, int $signCount):

Parameters

public function principal(): string

The principal spelling of this credential, parallel to «key:<fingerprint>» on the gpg path.