WebAuthn is enabled on Wikimedia wikis but only works if you log in on the same wiki where you have enabled it (T244088: Logging in at another wiki than WebAuth was set up fails). As part of SUL3 (T348388: Use central login wiki for login (SUL3)) we are moving login to a new dedicated domain, meaning WebAuthn would never work. We need to tell its current users to either disable it (and switch to OATH presumably) or migrate it to new domain (ie. disable their current WebAuthn keys and create new ones on the new domain - WebAuthn keys are domain-bound so there is no way to reuse them). Fortunately, only a handful of people use it.

For migration, we would first need to deploy T363695: Create a Wikimedia login domain that can be served by any wiki to production, and implement T362715: Move credentials change to central login wiki at least for WebAuthn. Disabling has no dependencies, we could start that conversation any time. It would of course result in loss of functionality, but WebAuthn is kinda broken for other reasons too (see T242031: Allow multiple different 2FA devices, T244348: Recovery option for WebAuthn, T363652: publicKey.pubKeyCredParams is missing at least one of the default algorithm identifiers: ES256 and RS256, T358771: Unable to login on iPhone with Passkey Enabled, and soon T363639: web-auth/webauthn-lib must be upgraded to 4+ for PHP 8.2+ support) so probably that's not a big deal.