Mike,

I was leaning the other way.  Since the NIST approach is forcing us to build loopholes in our criteria, I continue to think that being more specific limits the risk of ‘another version "born" outside of FIDO.’  NIST has been open about their lack of concern for assessable criteria, and building “flexibility/ambiguity” may make sense from their perspective; perhaps not from ours.

As written, the current guidance seems to be that Cryptographic Software Authenticators can now ignore the prohibition against “facilitate the cloning of the secret key onto multiple devices,” if they implement other controls that WE CANNOT assess.  I assume this is predicated on risk assessments performed by NIST on FIDO implementations and not hypothetical future protocols.  So, I’m thinking maybe we should consider retaining our limitation.  Someone comes up with a new approach, we can update again.  Even at our glacial pace, we’re still more agile than NIST.  😊

jimmy