WebAuthn will eventually replace TOTP as the recommended 2FA method, as it's more secure and easier to use.

Android has dedicated logic for TOTP-based 2FA, and I imagine it likewise needs dedicated logic for WebAuthn-based 2FA.

Currently for users who have chosen WebAuthn, the clientlogin API will return a WebAuthnAuthenticationRequest after the password entry, rather than a TOTPAuthenticationRequest. The workflow might change slightly after T242031: Allow multiple different 2FA devices is finished.