The attestation is about the device, not the website. I think just from a security perspective it makes most sense for the device or os manufacturer to handle

The attestation is about the device, not the website. I think just from a security perspective it makes most sense for the device or os manufacturer to handle attestation for that device.