Web Authentication does support being the only authentication mechanism, since it is in itself multi factor (in this case, physical possession of the phone and biometric confirmation)