WebAuthn is offered only with an active domain (the rpId) over HTTPS; bare-IP/HTTP returns false so a ceremony never runs with an invalid IP rpId. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>