Comment by throw7

As far as I've read here before, device attestation is definitely there, it's just not being used (one of the big tech namely Apple is balking... maybe they have their own means or plans in their ecosystem).

My main reason for not using it is I'm not interested participating in a scheme where I do not own/access the private keys and being able to use them and store them the way I want to.

I'm fine with TOTP and sure, I understand it's not phishing resistant by itself.