I received a response from Apple: "Promptly suspending when entering the background is correct behavior according to the norm of iOS." So just be aware that your message will be lost if you post it as your app enters the background.

I'm also interested in understanding if iOS, like Android, has implemented the proposed Device-bound Public Key WebAuthn extension (devicePubKey). This is described here: https://security.googleblog.com/2022/10/SecurityofPasskeysintheGooglePasswordManager.html Passkeys on Android support the proposed Device-bound Public Key WebAuthn extension (devicePubKey). If this extension is requested when creating or using passkeys on Android, relying parties will receive two signatures in the result..

Stumbled upon this today. Thank you, Quinn; happy to file a suggestion for this API: FB13152209.