Removing a strong factor is itself a sensitive action, so deletion is a two-step SCA ceremony proven with the passkey being removed. This call binds a deletion challenge to the named credentialId (the id returned by /corporate/passkey/list) and returns the WebAuthn assertion request for that credential alone: allowCredentials lists only the passkey being removed. An unknown credentialId is refused with 999998. The challenge expires after 10 minutes. Nothing is deleted by this call; complete the removal with /corporate/passkey/delete/confirm.