...The application enables users that have X.509 digital certificates (optionally, on smart cards—such as the PIV card or CAC) to strongly authenticate to PKI2FIDO using TLS ClientAuth and then register a FIDO Security key with a FIDO Server (such as StrongKey FIDO Server at https://sourceforge.net/projects/strongkeyfido/).
The TLS ClientAuth strong authentication process validates the digital certificate's chain (if any) and uses CRLs to verify the certificate's revocation status (OCSP checking will come in the next release).
Once the certificate chain is validated, it checks an LDAP server to determine if the user is authorized to register a FIDO Security key with the site.
...