@mjg59Matthew Garrett Shower thought, assuming hardware attestation lets you know the laptop logging in to your corporate system is legit, and U2F or something lets you know the user logging in is legit etc, do you also match up those two identities to prevent Bob from logging in using Alice's laptop? Is it common to do that, some kind of device+user allow list?
(I'm not setting up anything like this, just curious)