Man-in-the-middle attack against WebAuthn by a powerful attacker

Hello!

Have you considered that origin validation is not a sufficient
countermeasure against man-in-the-middle attacks in case of a powerful
attacker who controls responses to user's DNS requests and has a valid
certificate that is trusted by the user's browser for the target host?

Full details of the attack here:
https://gitlab.com/mrts/webauthn-additions/wikis/Man-in-the-middle-attack-against-WebAuthn-by-a-powerful-attacker

I have a proposal how to mitigate this, but I would like to hear
your thoughts regarding this first.

Thanks in advance for looking into this,
Mart Sõmermaa