A promising thing seems to be large-blob extension https://github.com/w3c/webauthn/wiki/Explainer:-WebAuthn-Large-Blob-Extension, but I haven't been able to make demos work yet so it's probably too early and not widely supported.