Even though the standard is still in draft, you could use ML-DSA with a yubikey through Chrome/Firefox already. The biggest issue is with the OS built-ins on iOS/macOs/Android, and that the entire Apple ecosystem doesn't support the PRF extension from external devices at this time, so it's hard to work around too.
So while the protocol is ready ever since IANA enumerated ML-DSA for COSE it's just that most of the "WebAuthn Relying Parties" don't implement it yet - standard changes during the draft period can be obstructive and there's not enough built into the OS' yet. If tomorrow Android and iOS also implement ML-DSA, it'll be out there in no time though. This is much further along.
Even though the standard is still in draft, you could use
ML-DSAwith a yubikey through Chrome/Firefox already. The biggest issue is with the OS built-ins on iOS/macOs/Android, and that the entire Apple ecosystem doesn't support the PRF extension from external devices at this time, so it's hard to work around too.So while the protocol is ready ever since IANA enumerated ML-DSA for COSE it's just that most of the "WebAuthn Relying Parties" don't implement it yet - standard changes during the draft period can be obstructive and there's not enough built into the OS' yet. If tomorrow Android and iOS also implement ML-DSA, it'll be out there in no time though. This is much further along.