This flow is also insecure.

Ideally, we make WebAuthn easier to use (via libraries, identity providers, etc), rather than, you know, replacing it with something less secure than passwords.

Just sayin’. ;)