Comment by WorldMaker

7 days ago

To fill out a bit more of the story, they also stopped supporting consumer attestation after arriving at a "good enough" compromise that they felt was more privacy supporting and better worked with backupable/syncable keys, the uvi and uvm extensions for Webauthn which they championed to standards. Once those standards were in place they especially saw no reason to support consumer attestation.

(Those extensions are for a Passkey manager to "solemnly swear" to an RP that a key was involved in some sort of MFA dance such as PIN unlock or biometric unlock and maybe a little bit of rough detail of what sort. Much more rough than Attestation details and not attested claims at all so a Passkey manager could lie about them, but that's enough for the sort of regulatory compliance or "due diligence" that many Banks might need from consumers to replace existing MFA logins with Passkeys. It is a relatively strong bulwark against attestation requirements for consumers.)