Single-use token carrying this sign-in's challenge, valid five minutes. Send it back with the assertion.
options object Required
`PublicKeyCredentialRequestOptionsJSON` to pass to `navigator.credentials.get()`. `allowCredentials` is empty, so the browser offers the passkeys it holds for the relying party, and `userVerification` is `required`.