# Limits

Stated at full strength, because an agent that knows the ceiling stops climbing.

## Enrolment is a human act

No tool, on either server, can enrol a passkey. A person creates one in their own browser, on a
site they are already signed in to. The agent path serves `navigator.credentials.get` and
deliberately does **not** serve `create`.

There is no fallback credential, no password, no TOTP seed, no backup code and no mailbox. If a
site is not connected, an agent cannot get into it, and no amount of retrying changes that.

## Roughly half of "passkey support" is not passkey sign-in

A large share of sites that advertise passkeys accept them only as a **second factor**, after a
password. A passwords-never product cannot serve those accounts at all. The connector notes say so
where it is known.

## Unattended sign-in is not solved

Every signature this service has produced for a real relying party required a human tap. That is
the honest configuration: the `UP`/`UV` flags are a signed factual claim, and the choice is
between gating each signature on a real approval or reporting the flags truthfully as `0` and
accepting what breaks. There is no third option in which the flags are true because it was
convenient.

## Custody

Keys are envelope-encrypted at rest: a per-credential data key wrapped by one master key,
delivered at start and held in plaintext only inside the process.

The production host **has no TPM**, so that sealing is host-key only — root on the box can recover
the master key offline. What contains that is approval gating, rate limits, an append-only audit
log and revocation, not the cryptography. This deployment is not hardware-sealed and is never
described as such. An HSM is the upgrade path and swaps exactly two functions.

## One relying party is properly proven

The first real end-to-end sign-in was against Google, with a browser holding no Google session,
using a key that has never existed outside the service. That is one site and one credential.
Behaviour on any other relying party is expected, not proven.

## The remote server has no browser

It signs bytes. It cannot click anything, cannot see your page, and cannot tell you whether you
have a session. An agent with no browser tooling can inspect and sign, but cannot complete a
sign-in — and the correct answer in that case is to say so, not to improvise.