This. Press it automatically.
There is separate Authorization Gesture needed anyway, ie touch on a hardware token.
Except, Safari/WebKit decided to be dicks: they want user interaction before allowing WebAuthn. Everyone else should not suffer because of this. A simple if statement for the User Agent would work just fine. I can’t confirm, but I heard GitHub is in the no-interaction-needed whitelist (where Google, Facebook, others are in) as well.
Worst case, it just falls back to press to ‘try again’, as the reject to authorize will be denied by the browser (first time).
@github-staff: is there any other reason I missed?