Couldn't, e.g., Apple implement attestation in such a way that you can move credentials between Apple secure enclaves, but still never export them in a way that

Couldn't, e.g., Apple implement attestation in such a way that you can move credentials between Apple secure enclaves, but still never export them in a way that you have control over them? That's what I'm worried about.