First of all, thank you for this project – this is amazing!

Something I'm having trouble wrapping my head around after reading the documentation (specifically the point on CTAP 2.1 hmac-secret compliance) and peeking at the code:

Does "Implemented with one secret (requiring UV) not two" mean that hmac-secret will only work when a PIN is provided during get() (and will reject either the extension or the entire get() operation otherwise)? Or will it just derive the same secret whether or not a PIN is provided during get()?