Read the headers a site sends, its disclosure file, a token’s contents, and which authenticator a passkey came from.