Local-First WebAuthn PRF AES-256-GCM