Verification and storage

type RegistrationVerification = {
  challenge: string;
  origin: string;
  rpId: string;
  credentialId: Uint8Array;
  publicKey: Uint8Array;
  signCount: number;
};

• Verify the challenge matches what you issued.
• Verify the origin matches your allowed origins.
• Verify the rpId matches your configured site identity.

What you keep for later

• credentialId so you can look up the right passkey later
• publicKey for verifying future assertions
• signCount as a cloned-key warning signal

If the signature counter goes backwards or stops behaving as expected, treat it as suspicious and trigger extra review or recovery.