They are trying to detect state actor hacking and track individual devices and whether they are new or impersonations of devices. Some states have mitm certs o

They are trying to detect state actor hacking and track individual devices and whether they are new or impersonations of devices. Some states have mitm certs on all their domestic machines but (hopefully) not much competence except on whatever schedule they buy updates. I would be implenting a u2f soft client in js if I were Google. IMO you need a private key a state would need to retrieve by tampering with js and that isn't being sent over the wire with every connection. (Just to give them their first level of headache, when it comes to transitioning from observing to impersonation.)