WebAuthn could eventually mean passwords are replaced with fingerprints and facial recognition. But how hard will it be to implement?