There's a separate attestation keypair that is static, is either unique per device or unique per 1k-100k batch of devices and signed by a manufacturer key. The

There's a separate attestation keypair that is static, is either unique per device or unique per 1k-100k batch of devices and signed by a manufacturer key. There's no need to keep a "root private key" on device. https://developers.yubico.com/U2F/Attestation_and_Metadata/ https://developers.yubico.com/U2F/Attestation_and_Metadata/ https://fidoalliance.org/fido-technotes-the-truth-about-attestation/ https://fidoalliance.org/fido-technotes-the-truth-about-atte...