Device attestation just proves you have realtime access to a legitimate device, and only makes sense where the other end of the transaction is trusted. Locally

Device attestation just proves you have realtime access to a legitimate device, and only makes sense where the other end of the transaction is trusted. Locally running software is never trusted. Its uses are mostly confined to authentication between corporate issued laptops and corporate VPN servers.