I’m 99% sure that I found a public consumer-facing website that is using and enforcing Passkey attestation.

Does anybody want to hazard a guess as to which website?