One of the main reasons for having a getCredentialSupport API is so that we select appropriate authentication mechanisms based on the credentials available to us or the level of validation possible.

This should also consider advertising all variants of a mechanism or strongest only.

I will mention it here but we may want as a separate task some form of downgrade detection as this could be a sign of a malicious MITM.