Never mind, I forgot to parse ASN1: $ echo 3024a1220420db05d53c0f14940df70f089b4563b0f6523fcde10cf02bb2b98027c796d0fc34 | xxd -r -p | openssl asn1parse -inform der     0:d=0  hl=2 l=  36 cons: SEQUENCE               2:d=1  hl=2 l=  34 cons: cont [ 1 ]             4:d=2  hl=2 l=  32 prim: OCTET STRING      [HEX DUMP]:DB05D53C0F14940DF70F089B4563B0F6523FCDE10CF02BB2B98027C796D0FC34

And in case you have trouble finding the Apple WebAuthn Root CA certificate: it is listed here - https://www.apple.com/certificateauthority/private/. (thanks, @alexseigler!)

Another use case for PRF is protecting identity wallets. PRF can be used to derive encryption keys that encrypt/decrypt identity data stored locally in a browser or remotely on some cloud storage. This currently works in Google Chrome. A demo of such a wallet can be viewed in the video embedded in a recent Yubico blog: "The first working demo of a web based EU digital identity wallet leveraging FIDO open authentication standards"