CanoKey supports the HMAC-secret extension, which allows applications to derive a secret from the key.
Due to a bug in the CTAP implementation, CanoKey firmware version ≤ 1.3 is incompatible with libfido2 1.7.0, and thus cannot be used with systemd-cryptenroll. Affected users should use libfido2 1.6.0.