I'm developing an Authenticator App for use towards my own API. I know about the TOTP standard RFC 6238 and the HOTP variant. Though I would prefer to use a public/private key based solution (by only storing the public key on the server).
What are some more or less standardized alternatives?
Is a home invented challenge response scheme with a public/private key pair subject to attacks (in the context of a secure HTTPS channel)?