> Apple's passkeys do not provide attestation Apple has their own anonymous attestation format[1] that some (unclear which?) of their WebAuthn authenticators s

> Apple's passkeys do not provide attestation Apple has their own anonymous attestation format[1] that some (unclear which?) of their WebAuthn authenticators support. In principle the relying party could use this to verify the authenticity of the authenticator back up to Apple's WebAuthn root CA[2]. In practice, I'm not sure if that attestation is included by default (or whether significant portions of users opt out of it, when prompted by their browser). [1]: https://github.com/w3c/webauthn/pull/1491 https://github.com/w3c/webauthn/pull/1491 [2]: https://www.apple.com/certificateauthority/Apple_WebAuthn_Root_CA.pem https://www.apple.com/certificateauthority/Apple_WebAuthn_Ro...