I am currently setting up WebAuthn for a service similar to Rancher using Keycloak. I have successfully configured WebAuthn and it is working as expected. To further enhance security, I have whitelisted specific AAGUIDs to enable only YubiKeys.

Now, I want to ensure that the YubiKeys used are only those that have been configured by myself, not just any randomly purchased YubiKey. The idea is to restrict the use of YubiKeys to the ones I have distributed to my team members, rather than allowing any YubiKey to be registered.

I am unsure if this behavior makes sense within the context of WebAuthn, or if it is even possible. If it is indeed feasible, could someone guide me on how to achieve this?

Any insights or suggestions would be greatly appreciated. Thank you in advance for your help!