Comment by fc417fc802

Right but when it comes to that plus BYOD isn't that how we end up at attestation in the first place? I figure the alternative is to manually enroll each device as its own known entity, then require two "regular" signatures to authenticate. Basically it's just the observation that if you care about whitelisting the hardware then you must either have attestation or else accomplish the same thing manually. The former is less labor intensive but comes at the cost of enabling abuse.