Verifies the assertion against the challenge issued by /corporate/passkey/delete and removes the credential that challenge was bound to. The assertion must be made by that very passkey: an assertion by any other passkey is refused with 999998 before it is verified. One challenge authorises one deletion: confirming an already-consumed challenge is rejected with 999998; an unknown or expired challengeId with 999995; an assertion that does not verify with 999998. The attempt cap is the same as for transaction challenges. The assertion request is single-use: if the assertion was accepted but the removal failed downstream, the challenge is handed back and the deletion is started again from /corporate/passkey/delete.