Embed Notice

@PlaneSailingGames @GossiTheDog

I am no expert on #Webauthn but maybe some "pure-device-based-no-backup" attestation type could be added. But then, in turn, the relying party would need to require that and only that. Unlikely to happen.

Does this mean that relying parties might need to maintain "trusted" lists of attestation CAs in the future?

Here it would be unlikely that Google, Apple and Microsoft certificates will not be included on those lists by default.

pls help @kravietz :)