ref: WebAuthn Level 3 — W3C Recommendation (25 August 2026). The web's ratified standard for public-key authentication. Passwordless, phishing-resistant, interoperable across browsers, devices and credential managers. No proprietary identity provider required. https://www.w3.org/TR/webauthn-3/