Can WebAuthn be used to fight sybil attacks? Is Attestation per-device?

My understanding is an authenticator can be a device (hardware) or software.

Yubico obviously have a vested interest in the hardware/device authenticator.

I'm never going to utilise a device as it seems to be a single point of failure and a good way of getting locked out of your accounts if device fails. And a way for hardware manufacturers to lock you into their ecosystem. And utilising two or move devices is not a valid work around, even though yubico might not agree.

This leaves software authenticators. To my understanding, this seems to be platform dependant. With Google, Microsoft, and Apple providing their own solutions. This is also not acceptable for vendor lock-in reasons and due to trust of these advertising companies.

I would only ever use this if like my password manager the authenticator was software based (hardware independent), platform independent, open source, and offline.

My issue is who controls the list of authorised authenticators. Because if it's the likes of the above mentioned advertising companies you know they want the keys to your kingdom.