What is an extended fingerprint (xfp) and how does it differ from an xpub? Coldcard requires the xfps of all of its cosigners to be able to verify and sign multisig transactions. Providing the coldcard with just the xpubs is not enough, which I believe to mean that the xfp can't be gleaned from the xpub. 

So, what is an xfp and how does it differ from an xpub?
The fingerprint of a public key is defined in BIP 32 as the first 4 bytes of the RIPEMD160 hash of the SHA256 hash of the public key. The fingerprint of a particular xpub can be gotten from that xpub, but this is not useful information.

What the Coldcard wants is the fingerprint of the master xpub. It wants the fingerprint of the key at derivation path m. This is because the Coldcard uses BIP 174 PSBTs. In particular, a PSBT can include the derivation path for a public key involved in an input in the PSBT. This derivation path will also include the master fingerprint so that the particular signer (e.g. hardware wallet) for that public key can be identified.

The master fingerprint provided does not need to be the actual master fingerprint. It just needs to be a fingerprint that will be present in the PSBT when the coldcard signs it. This way the coldcard will be able to know which xpub to use to derive a particular public key so that it can verify that the input is a multisig that it recognizes.