We don't need a signing authority. Those "attestations" are are anti-user security theater. We need to stop requiring apps for everything. The internet was designed to be used in a browser that can run anywhere. 2FA can be done with simple texts or phone calls.
We don't need a signing authority. Those "attestations" are are anti-user security theater. We need to stop requiring apps for everything. The internet was designed to be used in a browser that can run anywhere. 2FA can be done with simple texts or phone calls.
GrapheneOS does have their own device attestation sdk
Imagine the outcry. That would go against everything OS stands for, wouldn't it?
If you are a bank, you want to have an authority that guarantees OS hardware signing of a smart phone.
But this authority could be a bunch of cool people like Letsencrypt, instead of only Google.
OS isn't a co-ordinated movement with a single set of values.