WebAuthnRegistrationVerifier

Verifies one WebAuthn registration — the `navigator.credentials.create()` ceremony — and extracts the credential the house will remember: its id, its public key, its starting counter. Registration's load-bearing job is to come away with a REAL, verifiable public key bound to THIS challenge and relying party — the key that {@see WebAuthnAssertionVerifier} will later check assertions against. So this reads the attestationObject (CBOR), checks the create-ceremony's clientData binding and the authenticatorData (rpIdHash, user-present, the attested-credential-data flag), pulls the credential id and the COSE public key out of the attested credential data, and converts the key to PEM. ATTESTATION TRUST IS OUT OF SCOPE for v1 (greenhouse decisions/0123): this does not verify the attestation STATEMENT (packed/tpm/android-key signatures, certificate chains) — it extracts the key an authenticator presented, which is what a self/none attestation already amounts to. Statement trust, the challenge lifecycle, and non-ES256 algorithms are later slices built ON this one.

public function verify(string $expectedChallenge, string $rpId, string $clientDataJson, string $attestationObject): ?Milpa\Auth\WebAuthn\RegisteredCredential

Verify a registration and extract its credential, or return null when the proof does not hold.

Parameters