> ... will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations. DIY/CLI apps have no reason to include

> ... will likely mean you'll be generating that private key yourself, this makes you identifiable across registrations. DIY/CLI apps have no reason to include a legitimate attestation - attestations are used to convey trust in the implementation, such as 'This is a Yubikey 5i'. The public key is usable to look up additional metadata, such as passing conformance and security implementation tests. >Some sites (Cloudflare) may reject the use of attestation keys which are not found on the Fido Alliance Metadata Service. This precludes the use of any DIY solution. The feature is meant for higher security environments (say workforce and government employee/contractor) to reject a home-grown implementation. Cloudflare's (beta experiment) usage is a special case because they are using attestations to show that it is real hardware with a real financial cost. They are experimenting with using that as a replacement for captcha entering (while also experimenting with other technologies like privacypass to limit the number of times they ask for captchas). The alternative to attestations in both of these use cases is that FIDO is not acceptable at all, not that a DIY implementation would become accepted.