Sort of paused on this 
The issue with getting Webauthn to work is that right now, it only supports a single supported domain/origin. You can give it the custom scheme for your Capacitor app and it should work. But then it won’t work anywhere else. I haven’t taken a look at the source code yet to see if this is an easy fix, but @rob might know.
You’ll also need to change your cookie config to be SameSite: 'None', if you haven’t already done that (Cross-Origin Resource Sharing | RedwoodJS Docs). You might run into issues with that config in localhost, in which case what you need to do is set up your dev environment to have SSL enabled.
Let me know if you need help with that
Also, at least for an iOS app (or web app, on any Apple device), you can get an even better flow than Webauthn by using Sign In with Apple - 🎉 Announcing dbAuth OAuth Plugin v1.0.0 - easily enable Sign in with Apple, GitHub, Google, and more!