Mints a WebAuthn registration challenge and says what the ceremony will be, refusing anything knowable before the person touches their key.
the person
Optional
role (mfa by default), kind and label
role
mfa
kind
label
{ ok: true, enrolmentId, challenge, … }, or a refusal
{ ok: true, enrolmentId, challenge, … }
Mints a WebAuthn registration challenge and says what the ceremony will be, refusing anything knowable before the person touches their key.