I'm designing a web service meant for storing data for users, but these users don't have proper server-side accounts, just a random master key the user generated and stores on their device (a bip39 mnemonic) so they can derive some public-private keypair from it and use the public key as their "id" on the server to aggregate their data by.
The server should allow accessing/modifying the data stored only to the user that created the records. I believe this can be achieved by the user signing their request payloads with their private key and sending alongside the public key under which the server would store the records.
This looks to me almost like HMAC authentication, just the secret isn't a shared symmetric key between the server and the client, but rather an assymetric one. At the same time, I couldn't find any specification that would deal with asymmetric keys, perhaps WebAuthn comes close but the existing specs/implementations seem to be restricted to hardware devices (FIDO2) which doesn't apply to my use-case (the secret key would be stored on user's computer)
Can you point me at some web authentication standard that would be suitable for my usecase, removing the need to specify the solution/address potential issues like replay protection/etc. from scratch?