On: Web Authentication Methods Compared

[cratermoon]

You're correct they weren't required to accept "none" unquestioningly. Just that support for "none" was expected.

There's lots of possibilities for signed messages to simplify some things that are complicated if tied with maintaining session state on a server.