Comment by growse

> Where is it required?

Lots of places where you might have specific requirements about your authenticating users. E.g. to achieve FIPS compliance, or if your user population is low-single-digits because it's critical national infrastructure.

> I want them to all have to invent their own, so that most of them will make mistakes that let the attestation be bypassed and freedom be restored.

I most definitely do not want operators of CNI to be "inventing their own" that can trivially allow compromise or weakness. "User freedom" is not the prevailing value in a lot of authentication contexts.

https://cphpost.dk/2026-10-10/news/round-up/123456-password-...