Was discussing with @mohamedamir... we should say something in the spec that cross-platform cross-device credential exchanges SHOULD (or RECOMMENDED) happen over CTAP.

We can't mandate it (i.e., MUST) because:

• It's OS or framework specific, so outside of the scope of the spec... or, at least, what a browser can often do without implementation of the entire exchange stack.
• Platforms are free to use more efficient or propriety protocols, particularly for cross-device exchanges.
• Future proofs the spec, while giving best compatibility right now.