Its a per browser implementation decision, not required by the protocol. Chrome family browsers even ship a pure SW one but it's in the dev tools side.
I was basing that on what I've read so far about WebAuthn. How does Chrome handle key management? For example this is what the Wikipedia article says:
On the client side, support for WebAuthn can be implemented in a variety of ways. The underlying cryptographic operations are performed by an authenticator, which is an abstract functional model that is mostly agnostic with respect to how the key material is managed. This makes it possible to implement support for WebAuthn purely in software, making use of a processor's trusted execution environment or a Trusted Platform Module (TPM).
