The spec is way more detailed than it should be at this stage; it's not much more than my own opinions, mixed with a little bit of feedback from folks on Google's identity team and password manager team.
more here..............https://github.com/mikewest/credentialmanagement
more here..............https://github.com/mikewest/credentialmanagement