It's bad analogy. webauthn is quite far from just a protocol to verify keys.