I think understanding this distinction is going to be one of the main challenges for mainstream WebAuthn adoption over passwords as the default authentication method.