> then the other side has to decide whether they lock out & ban thousands of innocent users, or accept the loss of control My worry is more that relying partie

> then the other side has to decide whether they lock out & ban thousands of innocent users, or accept the loss of control My worry is more that relying parties will ban all providers except for (more or less) iOS and Android and Windows clients. That would cover probably 99% of users, but as a side-effect, effectively completely ban open source software from logging in to the service. It's not hard to see a well-meaning person flipping the switch to only allow big-name providers in the name of "security," especially given the existence of the spooky non-compliant list actively maintained by the spec authors. It's true we could work around this by stealing the tokens from approved software, but I am extremely uninterested in having my authentication rely on stolen attestation tokens.