I worry that more and more security people will make their orgs require authenticator attestation, which basically compares a burned-in cert against those certs

I worry that more and more security people will make their orgs require authenticator attestation, which basically compares a burned-in cert against those certs blessed by FIDO. If too many websites submit to that stupidity, the idea that you can use your Bash-scripted password manager for resident key auth becomes a figment.