Actually, these two things are orthogonal. If you require some kind of authentication process to prove your identity, it doesn't matter whether your device has

Actually, these two things are orthogonal. If you require some kind of authentication process to prove your identity, it doesn't matter whether your device has TPM-supported device attestation or not. If Apple or Google wanted to do that, they already have the in-browser infrastructure for it in the form of login with Apple or login with Google. Making such a thing anonymous for third parties (so they just know it's a human, rather than which human) would be trivial.