... process validates the digital certificate's chain (if any) and uses CRLs to verify the certificate's revocation status (OCSP checking will come in the next release).
Once the certificate chain is validated, it checks an LDAP server to determine if the user is authorized to register a FIDO Security key with the site.
Since PKI2FIDO is a sample application, a De-register button is enabled to delete FIDO keys; This enables the user to keep testing with the same username.