No need to speak roughly.
Most sites should just not care, but it's an option if you've determined there's a specific reason it matters in your application.
Websites should not depend on JavaScript for something that should be able to be done declaratively.
(Amongst other things - we shouldn't need to use `fetch`/`XMLHttpRequest` when a <form> would work just-as-well - but if only <form> let us use more than just GET and POST, and supported more types of serialization, and supported asynchronous form submission - and bring back <keygen>!).
And yes, there is a way to use it without a TPM technically, but it's not accessible by the computer's management GUIs, and you need to create custom GPOs and apply them.
There are UX issues there that have to be solved yet. Also, while I haven't gotten my hands deep in what Apple has done yet I suspect this is a browser-level feature and not a platform-level feature, where say your phone would pop up a "do you want to authenticate" screen when held near another computer with BLE the same way you get "do you want to use Apple Pay" today.
Platform level support would allow me to use this directly within other applications and browsers, rather than just from Safari and the SFSafariViewController/ASWebAuthenticationSession Safari-managed views.
As I see it, data is stored in a secure enclave separate from the processor and OS. It only provides a match value based on the generated digital private key. So phones will create a separate pair for every site and send the public key with credentials so the server can verify it with the device.
Wouldn't apple have to open source their hardware as well?
Here, the iPhone functions as a platform authenticator, like a U2F usb/nfc key would. Why would they need to open source their hardware for this?
Typically deploying WebAuthn means that you have to put more thought into your account recovery flows - you don't want to deploy strong authentication to fall back to email or KBA-based recovery, for example. Then, this recovery may be used both to recover from a lost device as well as to just add a second device.
General advice: If worried about losing a device, try to register more than one. Even iCloud Keychain requires other hardware for authentication... same problem applies.
Only way out is having a backup like taking ID to an Apple Store as a way to regain access... that varies right now by provider, but who knows. Maybe Login with Apple will go WebAuthn-compatible in future? (Haven’t watched this video yet.)
If you’re an enterprise and worried about key authenticity or varying WebAuthN standards, you can look for specific types of keys or even request specific serial numbers of FIDO2 dongles from the web browser, etc.
But for normal people, we do need to get more of the balance into the usability side I think. The thing with iCloud Keychain is it can comfortably be recovered without breaking the end-to-end encryption with only a single remaining device, and many Apple users have as many as 3-4 devices in the circle of trust
It seems ideally some kind of "roaming platform" additional option would be good in the webauthn standard
[1]: https://www.w3.org/TR/webauthn/#platform-authenticators
It's a really good idea. I can see there being a big demand for just simplifying signin - I can easily see a time where it is worth not having the hassle of managing multiple signin processes and just choosing webauth or nothing.
Edit: to be clear this won't affect B2C sites whose monetisation is based on getting as many people as possible. But imagine a saas business charging upwards of 100 bucks a month - they have something valuable to protect, and the security story just got a lot easier