TechFeb 28, 2026updatedWebAuthn PRF for encryption keys? The spec co-editor says don't — lost authenticator means lost dataW3C WebAuthn L3 co-editor Tim Cappalli warns against deriving encryption keys from the passkey PRF extension. Why the data becomes permanently unrecoverable, how Bitwarden and WhatsApp handle it, and the envelope-encryption pattern to use instead.PasskeysWebAuthnSecurityFIDOEncryption
