Treat rpId as an origin.

index.bs

@@ -437,6 +437,9 @@ When this method is invoked, the user agent MUST execute the following algorithm
         are thrown, set |rpId| to the value of `host` as computed by this procedure. Otherwise, reject |promise| with a
         <a>DOMException</a> whose name is "SecurityError", and terminate this algorithm.
 
+    Issue(w3c/webauthn#259): The rest of this algorithm assumes |rpId| is an
+    [=web/origin=], but the above step sometimes produces a string.
+
 4. Let |normalizedParameters| be a new [=list=].
 5. [=list/For each=] |current| of {{cryptoParameters}}:
     - If <code>|current|.{{ScopedCredentialParameters/type}}</code> does not
@@ -469,7 +472,7 @@ When this method is invoked, the user agent MUST execute the following algorithm
     : {{challenge}}
     :: The [=base64url encoding=] of {{attestationChallenge}}
     : {{origin}}
-    :: |rpId|
+    :: The [=unicode serialization of an origin|unicode serialization=] of |rpId|
     : {{hashAlg}}
     :: UA-chosen