We don't need a signing authority. Those "attestations" are are anti-user security theater. We need to stop requiring apps for everything. The internet was designed to be used in a browser that can run anywhere. 2FA can be done with simple texts or phone calls.
replyGrapheneOS does have their own device attestation sdk
replyImagine the outcry. That would go against everything OS stands for, wouldn't it?
replyIf you are a bank, you want to have an authority that guarantees OS hardware signing of a smart phone.
replyBut this authority could be a bunch of cool people like Letsencrypt, instead of only Google.
OS isn't a co-ordinated movement with a single set of values.
reply