Everything I Learned Shipping Device Bound Session Credentials

We shipped Device Bound Session Credentials at Report URI, open-sourced the server-side implementation, and then discovered a long list of things the specification doesn&apos;t prepare you for. Some caused random logouts. One could deadlock a browser tab indefinitely. Two silently turned a device-bound session back