@ScottHelme

The post makes what appears to be one central claim: Passkeys support something called attestation, which lets a website ask for cryptographic proof of what made the passkey. [...] The post describes attestation as proving "that an approved passkey manager, operating system, and firmware are in use" which is simply not true. When it is present, WebAuthn attestation tells the site the make and model of the authenticator, identified by its AAGUID, with a certificate chain from the vendor to back it up. It says nothing about your OS, your browser, your extensions, whether your phone is rooted or jailbroken, your firmware version, or even what colour it is.

Made me fact-check it. My impression from the referred post was that it's speculation about WebAuthn possibly getting extended. Holy shit, the spec already has a section for SafetyNet.
https://www.w3.org/TR/webauthn-2/#sctn-android-safetynet-attestation

This makes the quote bullshit as these responses include or omit a MEETS_DEVICE_INTEGRITY bit, per docs: "The app is running on a genuine and certified Android device. On Android 13 and higher, there is hardware-backed proof that the device bootloader is locked and the loaded Android OS is a certified device manufacturer image." https://developer.android.com/google/play/integrity/setup#configure-api