@ScottHelme Overall I agree but I am unsure if the key statement is true in every case:

> The post describes attestation as proving "that an approved passkey manager, operating system, and firmware are in use" which is simply not true.

At least for Android I think this might be untrue in certain although rare situations (though very unlikely, as it only works for device bound ones).
As per this press release - https://android-developers.googleblog.com/2024/09/attestation-format-change-for-android-fido2-api.html?m=1 - the attestation for such keys is based on https://source.android.com/docs/security/features/keystore/attestation . And this includes OS, vendor and patch versions.

I am also unsure what the TPM attestation when using Windows Hello includes and attests

For device bound credentials on Apple devices there is also something similar, but this seems to be connected to MDM scenarios (so passkey usage might be mandated by an employer anyway, therefore any discussion about a choice in that situation is pointless).

All of this seems to be a very edge cases that should not stop anyone to use passkeys.