Passkey creation fails with SecurityError when the origin is app.tempo.local and the RP ID is tempo.local.
Chrome validates WebAuthn RP IDs against the Public Suffix List (PSL). Both the origin host and the claimed RP ID must have a registry-controlled domain per the PSL. .local is not in the PSL — it's an IANA special-use domain reserved for mDNS (RFC 6762).