I tried to use the instructions to install my thetis fido2 key last week on a since deleted install, but noted that despite everything seemingly being accepted by dom0 to restrict access some of my VM’s when I input the instructions from the instructions sheet, I could still access the qubes for which I had attempted to restrict access without needing to use the key.
That said, given that FIDO2 was explicitly mentioned within the instructions, I assumed that I had somehow messed it up rather than the system itself being at fault. It was one of the reasons for my change in deployment strategy (I have now set up a test install and a production install, so that I can use the test environment to experiment with features and ensure they work properly before going live with them on the production install).
thanks, i got myself a local docker env and could reproduce. since nitrokey works fine on github, gitea, and others as webauthn (and passkey…) i suspect dicourses implementation might be the cause and will follow deeplows recommendation.