Users register by creating a cryptographic key pair, then subsequently authenticate using digital signatures.
Private keys are securely stored on a user's device and never leave.
Key pairs are bound to specific domains, so browsers automatically prevent cross-site phishing attacks.