OATHAuth provides the infrastructure for 2FA support, and contains a TOTP code-based module provider. It's also bundled with the tarball. WebAuthn extends upon that by adding a provider for Yubikeys and similar devices.
It would be easier to make changes to OATHAuth if all the code was contained in the same Git repository. Also these days WebAuthn is an well-known standard and for 2FA purposes, using security keys is generally expected as an addition to TOTP. It would be good if we could ship both with minimal setup.
Given that we do want to bundle WebAuthn (T258007: Bundle WebAuthn extension with MediaWiki), merging would be another way to get to that goal.
The main blocker is the current WebAuthn library depends on the gmp extension, which the tarball currently doesn't. That dependency should be removed or be made a core dependency.