Past ceremonies
Every ceremony this server has run, successful or not. Stored in sqlite.
What you are looking at
Four messages cross the network in a WebAuthn ceremony: the client asks to start, the server sends a challenge plus its policy, the browser and authenticator do their work locally, and the client returns a signed response. The steps labelled Browser → Authenticator are reconstructed — they happen inside the platform and no server can observe them — but every value shown in them is determined by what the server sent and what came back.
Nothing secret ever travels. The private key stays in the authenticator, the biometric never leaves the device, and the server's entire stored secret is a public key.