DBSC Explained: How Device Bound Session Credentials Actually Work

Chrome shipped DBSC to stable in 146. Here's the whole protocol — registration, challenge signing, the refresh cycle, what the TPM does, and what it actually protects — with no framework in sight.