Comment by coldpie

This is a pretty unconvincing argument. It's just one guy saying "trust me, no one will abuse this." It's especially unconvincing when you've got this other Passkey dev directly contradicting it:

> To be very honest here, you risk having KeePassXC blocked by relying parties. ... I've already heard rumblings that KeepassXC is likely to be featured in a few industry presentations that highlight security challenges with passkey providers, the need for functional and security certification, and the lack of identifying passkey provider attestation (which would allow RPs to block you, and something that I have previously rallied against but rethinking as of late because of these situations).

https://github.com/keepassxreboot/keepassxc/issues/10407#iss...

They need to remove attestation from the spec. Instead of promising no one will ever use it, just get rid of it and solve the problem.