WebAuthn in an iframe

Create (non-SPC) passkey

Trigger first-party SPC