What would you like Teleport to do?

We frequently use hidden WebAuthn diagnostic commands as form of debugging. These are:

• tsh fido2 diag
• tsh webauthnwin diag
• tsh touchid diag

Since admin actions tctl is capable of WebAuthn, so we should port the diag commands to it as well.

As a bonus we could unify the commands, so only port (and call) a single additional hidden command.

What problem does this solve?

Better diagnostics of tctl MFA issues.

If a workaround exists, please include it.

Run the commands on tsh for general system diagnostics.

Run tctl -d and inspect the outputs.

These are reasonable proxies, but not equivalent.