What WebAuthn signCount tells you: the counter check and clone signals
Per WebAuthn Level 3: what signCount counts, when it stays at zero, the exact comparison an RP runs, why a lower or equal value is a signal rather than proof, and how the BE and BS flags relate.
webauthnpasskeyauthenticationsecurity