WebAuthn in an iframe
Create (non-SPC) passkey
Trigger first-party SPC