[Fetch] What's stopping us from using the Fetch API configuration to support this?

[wparad]

After thinking about this a lot more, it seems like there is a real opportunity here to move the configuration into the fetch api for browsers. This is going to be api requests, and fetch will likely ultimately be used here, fetch could just take in a new parameter for session management:

await fetch('/sessions', {
  method: 'POST',
  sessionConfiguration: {
    type: 'TOTP / TPM / HOTP',
    expiry: 60000,
    metadata: {
       sessionIdentifier: 'hello'
    }
  }
});

And then for each subsequent request, fetch could inject in a header with the signature automatically if configured:

await fetch('/sessions', {
  method: 'POST',
  sessionConfiguration: {
    enabled: true
  }
});

Or whatever, seems like an easy solution here, what am I missing?