Comment by LoganDark
5 days ago
Thanks. It's unfortunate that some of them decide to use the key attestation API. I guess that's one of its intended purposes, but not where I'd personally like to see it. Just a little salty that certain things like rooting will be forever out of reach on GrapheneOS for users of those apps, because you will never be able to do that with the official signing keys.
We try to convince them not to do it at all, but if they insist on doing it then we point them to our signed list of verified boot key fingerprints and Google's library for key attestation verification. We have a page with a guide on allowing GrapheneOS this way for apps using the Play Integrity API. We keep a list of a small subset of apps using the Play Integrity API to ban GrapheneOS there for users to pressure them to allow GrapheneOS too. We definitely don't encourage adopting it for apps not using the Play Integrity API already but rather it's a compromise to get support for the official releases of GrapheneOS and other operating systems with verified boot and the app sandbox intact for apps otherwise banning them.
I do agree with the compromise in that situation, as it's clearly better for users.