The Digital Credentials API requires transient activation (a user gesture) before presenting the credential chooser. This check is enforced in the web content process via consumeTransientActivation() in DigitalCredential::discoverFromExternalSource(). However, if the web content process is compromised, an attacker could bypass this check and send the ShowDigitalCredentialsPicker IPC message directly to the UI process. The UI process currently trusts that the web content process already validated the user gesture. WebKit already has a UserGestureAuthorizationToken system for navigations (window.open): the UI process mints a UUID when dispatching input events and verifies it when the web process claims a navigation was user-initiated (see WebProcessProxy::consumeIfNotVerifiablyFromUIProcess). We should extend this pattern to the Digital Credentials API: 1. Add a std::optional<WTF::UUID> gestureAuthorizationToken parameter to the ShowDigitalCredentialsPicker IPC message 2. In the web process, capture the token from UserGestureIndicator::currentUserGesture()->authorizationToken() before sending the IPC 3. In the UI process handler (WebPageProxy::showDigitalCredentialsPicker), verify the token against the recorded authorization tokens using MESSAGE_CHECK This provides defense-in-depth: even if the renderer is compromised, the UI process independently verifies a real user gesture occurred before showing the credential picker.