Comment by oefrha

For starters, AAGUID already reveals the passkey provider. It can be spoofed without attestation, but good faith (debatable choice of phrase obviously) users already reveal more about themselves, a fair bit more depending on who you ask and how unusual the choice of passkey provider is.