We propose Dynamic Digital Identity (DDI): an authentication mechanism that issues, at each login, an ephemeral identity (a "mutating key") only after a cryptographic proof of possession of a private key protected by hardware on the user's device. Unlike SMS OTP or 2FA over fragile channels, DDI combines WebAuthn/FIDO2 (proof of possession and device attestation when applicable) with shortlived session tokens signed by KMS/HSM and channelbound to prevent replay. We discuss the threat model, security properties (resistance to phishing, replay, SIM swap, and credential cloning), and an evaluation plan with technical and usability metrics. We situate the work relative to standards and guidance (W3C WebAuthn, FIDO2/CTAP; NIST SP 800-63B-4; CISA/GSA). Expected results: reduced attack surface compared to SMS OTP and secret-reuse MFA, without requiring dedicated external apps [1], [2], [3], [4].