sequenceDiagram
    Client->>Device: MakeCredential
    Note over Client,Device: Optional - exclude-list=[credential-id='<some-cred>']

    opt exclude list not empty
        Device-->>Keyring: Find credentials
        alt found
            Keyring-->>Device: Found excluded credentials
            Device-->>Client: Ctap Error CREDENTIAL_EXCLUDED
        end
    end

    Note over Device: 1. Create key-pair for the given COSE algorithm
    Note over Device: 2. Encrypt key-pair with a random UUID4

    Device-->>Keyring: Save b64 encoded algorithm + encrypted key
    Keyring-->>Device: Saved

    Note over Device: 1. Sign authenticator-data + client-data-hash
    Note over Device: 2. Create packed attestation object

    Device->>Client: AttestationObject
