32-byte PRF output — deterministic for the same passkey + salt. Null if the authenticator doesn't support PRF or the extension wasn't evaluated.