The Nitrokey FIDO2 guide states: "The first FIDO operation is automatically accepted within two seconds after connecting Nitrokey FIDO2." The website usually decides about your PIN The second uncomfortable point: even a PIN that is set does not mean it will be requested. For you that means: without a PIN set, even preferred will not ask. The second half of the table shows what happens when the PIN does not fit after all. For the device PIN that holds, for the FIDO2 PIN it does not: that one is "entered via keyboard", OnlyKey writes in its own command documentation.