Looking at #220 and #222 (and based on comments @npdoty made somewhere), I think we should discuss the privacy considerations of whether and how user agents handle multiple credential requests and presentations - there were some concerns called out such as over-asking and difficulty of designing a permission experience.