Skey: a FIDO2 security key on the Raspberry Pi Pico

Firmware for the Pico / Pico 2 that acts as a USB FIDO2 authenticator:
CTAP2 and U2F, passkeys, BOOTSEL as the touch button, and clientPIN with
PIN/UV auth protocols 1 and 2. A host simulator runs the same core so the
python-fido2 test suite exercises it without hardware.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/cred.h

@@ -0,0 +1,19 @@
+// Credential IDs are self-contained: the private key is re-derived from the
+// device master secret, so non-resident credentials need no storage.
+//
+//   credential ID = version (1) || nonce (32) || tag (16)
+//   private key   = HMAC(master, "skey-key" || version || nonce || rpIdHash)
+//   tag           = HMAC(master, "skey-tag" || version || nonce || rpIdHash)
+#pragma once
+
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdint.h>
+
+#define CRED_ID_LEN 49
+
+// Makes a new credential bound to rp_id_hash.
+bool cred_create(const uint8_t rp_id_hash[32], uint8_t cred_id[CRED_ID_LEN], uint8_t priv[32], uint8_t pub[64]);
+
+// Recovers the private key if this device issued cred_id for rp_id_hash.
+bool cred_unwrap(const uint8_t rp_id_hash[32], const uint8_t *cred_id, size_t len, uint8_t priv[32]);