A user protected by FIDO2 lands on a fake site that perfectly imitates their bank. Why does the attacker fail to obtain valid access?