Re: [webauthn] Add Credential Manager Trust Group Key (CMTG) extension (#2338)

I need to get this out of my system: CMTG sounds like a magic the gathering variant... maybe commander or something.

> A credential manager that supports CMTG Keys will always return one if requested. 

I don't think this should be the case:

* An implementation that exchanges information related to the (non) remoteness of devices with a server component may not be able to produce a CMTG key if the network is down (but can otherwise produce a WebAuthn credential).
* The UA may support CMTG, but perhaps the authenticator doesn't. I would prefer not to exclude those authenticators. CMTG should be seen as a "nice to have".

Unless there's a strong reason for this, we should allow a CMTG key to not be generated even if requested.

-- 
GitHub Notification of comment by nsatragno
Please view or discuss this issue at https://github.com/w3c/webauthn/issues/2338#issuecomment-3453016637 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Monday, 27 October 2025 19:42:36 UTC