Comment by notpushkin

> You can try and set up a neutral clearinghouse vetting attestation providers, but that itself will probably become a centralizing force itself, requiring expensive audits etc.

It is a problem, but isn’t FIDO acting as this body already wrt attestation in WebAuthn? I’m only building on top of this existing process.

Regardless, a sibling commenter has a good idea of how to sidestep this in corporate environment, and I think it should work for most of actually useful purposes.

> I think shunning attestation is largely the right move

I’m glad we’re on the same page :-) But as long as we have attestation for passkeys, I think we should at least make it as hard as humanly possible to (ab)use it as a general device attestation scheme.