0.1.0

First release. It adds passkeys and security keys as a second factor for the Human Made fork of Two Factor. It is a second step after the password. There is no passwordless sign-in.

What it does:

• Users add, rename and remove passkeys on their profile. Adding the first passkey turns the provider on.
• Administrators can rename and remove other users' passkeys, but they cannot add them.
• The login step asks for a passkey after the password. Backup methods stay available.
• It works on the force-2FA screen and in the session-expired login modal.
• If a passkey's sign counter goes backwards, the plugin disables that passkey, because it may have been copied.
• On multisite, a passkey works only on sites with the same RP ID. A filter lets subdomain networks share passkeys.
• Deleting the plugin removes all passkey data.

Before you install:

• It needs the master branch of humanmade/two-factor. It is not tested with upstream Two Factor or the fork's 0.3.x tags.
• It needs HTTPS. Plain HTTP works only on localhost.
• It needs PHP 8.2 and WordPress 6.6 or later.
• If you deactivate the plugin, users whose only second factor is a passkey sign in with just a password.

The WebAuthn library is bundled, so the source zip installs as it is. See the README for setup, hooks and limits.