The key-agreement keys in the PIN protocol use COSE type -25. I'm not sure if that's written down anywhere, but it's what everything else does and it's an ECDH type rather than an ECDSA type.
CTAP2 specifies that an empty pinAuth field is special: it indicates that the device should block for touch, i.e. it's just a way of letting a user select from multiple authenticators[1]. This change handles empty pinAuth fields in GetAssertion and MakeCredential commands. [1] https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#using-pinToken-in-authenticatorMakeCredential
Adam Langley