Private
Physical security keys only (3 enrolled). After sign-in this device stays trusted for 1 month. Each unlock still needs Face ID / Touch ID — or a 6-character passcode if this device has no biometrics. No passwords.
Mock sign-in — not real WebAuthn yet
Live design: one of 3 physical keys → then biometrics, or 6-char passcode if none. See AUTH.md for key registration.