@Goosth observes [1] that one SPC examples refers to userVerification in a WebAuthn credential creation. I think it would be useful to include a statement about how the SPC UX is (or is not) affected by this WebAuthn parameter. For example, in the "Steps to respond to a payment request" algorithm (à la WebAuthn [2]).
This seems to be satisfied by the PR that was landed for it? Long term questions about requiring (or not requiring) UV are also reasonable, but this issue isn't tracking any specific need for that, so closing.
@Goosth observes [1] that one SPC examples refers to userVerification in a WebAuthn credential creation. I think it would be useful to include a statement about how the SPC UX is (or is not) affected by this WebAuthn parameter. For example, in the "Steps to respond to a payment request" algorithm (à la WebAuthn [2]).
[1] https://github.com/w3c/secure-payment-confirmation/pull/103 [2] https://w3c.github.io/webauthn/#sctn-createCredential