WIP documentation of the WebAuthn signature payload

docs/en/pact-reference.md

@@ -243,6 +243,33 @@ signers:
 type: exec
 ```
 
+### WebAuthn Signature Format
+
+The Pact REST API can accept transactions signed by the WebAuthn protocol.
+
+A web client can use this scheme for authenticating and
+signing Pact transactions without manually managing private keys. The client must:
+
+ - Modify the `Signer`, it must have `scheme` set to `"WebAuthn"`.
+ - Construct the challenge as: `base64( blake2b ( CommandPayload ))`
+ - Issue a JavaScript `navigator.credentials.get` with this challenge.
+ - Construct a `Signature` from the credentials response.
+ - Prefix any public keys generated by the WebAuthn client with `"WEBAUTHN-"`,
+   both in the `signers` field and in any keys supplied via env data.
+
+The `"signature"` to pass to Pact (in the `"sigs"` field) is a stringified JSON
+object composed of pieces taken from the browser's credential response, (the
+`response` object, below). Some of the response fields must be converted from
+the Base64URL alphabet to Base64:
+
+```
+{
+  "signature": toBase64(response.signature),
+  "authenticatorData": toBase64(response.authenticatorData),
+  "clientDataJSON": toBase64URL(response.clientDataJSON)
+}
+```
+
 
 Concepts {#concepts}
 ========