Like any attestation scheme, it doesn't prove anything about the humanity of the button-presser, only that software, hardware, or flesh triggered an action in i

Like any attestation scheme, it doesn't prove anything about the humanity of the button-presser, only that software, hardware, or flesh triggered an action in iOS. hCaptcha's announcement goes into a bit more detail on the tradeoffs: https://www.hcaptcha.com/post/announcing-support-for-private-access-tokens https://www.hcaptcha.com/post/announcing-support-for-private... The main benefit over traditional hardware attestation is that RSA blinding is used to avoid linkability to a single device.