Yes exactly. With the caveat that an untraceable token can be passed to someone else. So then there are the shady remote attestation schemes that try to make su

Yes exactly. With the caveat that an untraceable token can be passed to someone else. So then there are the shady remote attestation schemes that try to make sure that only your smartphone can use that token that was generated for you, and this is very very bad in my opinion. But if you accept the caveat (like we do for cigarettes, where an adult can buy cigarettes and then give them to a kid), you don't need to remote attestation part.