schema and migration;

Owner/parent-authorized enrollment;

client Ed25519 key generation;

non-exportable private-key persistence;

public JWK registration;

single-use challenges;

server signature verification;

proof-bound sessions and requests;

replay protection;

rotation and overlap;

extension UI;

tests and documentation.