Section of the spec this relates to --> https://html.spec.whatwg.org/multipage/webappapis.html#safelisted-scheme

Description of problem:
I have a web application which handles storing and generating time-based one-time-passwords (TOTP). Most services which implement multi-factor authentication (MFA/2FA) surface the otpauth link as a QR-code for the user to scan. I would like to register my web application to handle these links, much like native applications can such as Google Authenticator and Authy.

Solution:
Add otpauth to the safelisted scheme list, this will mean user-agents will no longer throw a "SecurityError" DOMException.

This is the change I would like to make:

 - bitcoin
 - geo
 - im
 - irc
 - ircs
 - magnet
 - mailto
 - mms
 - news
 - nntp
 - openpgp4fpr
+- otpauth
 - sip
 - sms
 - smsto
 - ssh
 - tel
 - urn
 - webcal
 - wtai
 - xmpp