This sounds like exactly what WebAuthn is for, and even better, it's already implemented in browsers and available as a JS API!