Protected bootstrap

Create an admin passkey

The one-time enrollment code authorizes the first credential only. It is never accepted by the sign-in page.