Completing the passkey (WebAuthn) linking flow — where does the WebAuthnResponse come from for a server-side companion?

[cit-zortea]

I'm running a multi-tenant service that links business accounts as companion devices via GetQRChannel. Since late June a subset of accounts (all WhatsApp Business) now trigger the passkey flow: after the QR scan I get a PairPasskeyRequest event with PublicKey.AllowCredentials empty (i.e. a discoverable credential is expected), RelyingPartID = whatsapp.com. On older builds this ended in "device removed" ~17s after "Successfully paired"; on b572e5b I now correctly receive the PairPasskeyRequest instead.
I've read pair-passkey.go and types/passkey.go. I understand the library transports the challenge and transmits the response via SendPasskeyResponse(ctx, *types.WebAuthnResponse), but does not produce the assertion itself — the WebAuthnResponse (with AuthenticatorData + ClientDataJSON + Signature) has to be supplied by an authenticator that holds the credential for whatsapp.com.
My questions:

For a server-side companion (no local FIDO authenticator, credential lives on the account owner's phone), is completing this flow expected to be possible at all — or is SendPasskeyResponse intended only for clients that can drive a real WebAuthn ceremony bound to the whatsapp.com origin?
If it is possible, where is the WebAuthnResponse expected to come from in practice? Is there a supported hand-off path where the phone signs the challenge and the companion only relays the resulting assertion?
Does SkipHandoffUX on PairPasskeyConfirmation relate to this — i.e. is there a mode where the phone-side confirmation replaces the need for the companion to submit a signed assertion?
Is anyone successfully linking a passkey-gated account with a headless/server companion today, and if so, what does the authenticator side of SendPasskeyResponse look like for you?

Thanks — trying to determine whether this is an implementable hand-off or a hard wall for non-official server-side clients before I build around it.

[jobasfernandes]

Do they use AI even to leave a comment?