Comment by scotty79

> WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up.

How's that not just a terrible idea that leads to all of the aforementioned scenarios?

By adopting this you give the site ability to require a specific app and/or hardware for keeping your keys.