☥ ANKH
Security
ANKH is built around phishing-resistant passkeys, explicit assurance and recovery controls that are treated as part of the security boundary.
Passkey-first authentication
WebAuthn user verification is required for the ANKH credential path. Private WebAuthn keys remain in the authenticator and are not sent to the ANKH service.
Federation
Application federation uses OpenID Connect with Authorization Code and PKCE. Client and redirect policy are enforced by the identity service rather than reimplemented independently by each application.
Recovery and evidence
The recovery design uses threshold controls and durable state. Security, hardware and certification statements remain limited to mechanisms for which current implementation evidence exists.