Potentially, yes. Authenticators can provide a public certificate, so servers can accept attestations created through whitelisted authenticators. This would me

Potentially, yes. Authenticators can provide a public certificate, so servers can accept attestations created through whitelisted authenticators. This would mean being forced to use proprietary hardware or closed-source authenticators, because that’s the only way to control authenticator certificates.