Proving that a public key is associated with a hardware-backed private key is done in different ways on different platforms (Exposed TPM interfaces do it one way, Android another, ChromeOS yet another, and Apple different yet again). Is the right way for services wanting hardware-backed keys to handle all the attestation paths themselves, or should you have one service that issues a certificate upon successful attestation and then use that as proof for others?

0

If you have a fediverse account, you can quote this note from your own instance. Search https://nondeterministic.computer/users/mjg59/statuses/114854375705424043 on your instance and quote it. (Note that quoting is not supported in Mastodon.)