Ardis Lu [Mon, 21 Jul 2025 03:47:34 +0000 (20:47 -0700)]
Remove challenge
Challenge does not make sense in this context because both passkey creation and retrieval are entirely client-side.
The signed challenge is also not verified, and so challenge is actually unused and could be replaced by any junk value in the output content without affecting the decryption.