I just thought I'd found a bug in http://w3c.github.io/webauthn/#op-make-cred because on initial read it seems that even though there's a match for an excluded cred, the user is asked for verification and the authnr is supposed to go ahead and create a cred. However, upon searching issues, and reading further in that step to discern that errors are returned in any case, this is all being done for privacy-preserving reasons (see issue #806 )

if we have cycles we ought to put a Note: in that step wrt what's going on...