Both Apple and Google use webauthn as second factor, never the first.