> The major one is that there should be some way to do attestation of devices that are not Google-certified Android or iOS.

IMO, just don't do the proof of possession. If I have the token that says I am an adult, I can use it to be considered an adult online. If someone requests millions of tokens and sells them, then punish that someone. It's not very hard to find them: they have to sell those tokens somewhere.

Also don't try to solve the VPN issue: I highly doubt most kids will use VPNs to access social media, and accessing porn isn't that hard if you are capable of running a VPN.

Again, I can consider age verification as some kind of "inconvenience for under age people". But the age verification that works 100% of the time is a problem, as you say it will lock people out with remote attestation and that is not acceptable.