The web has two horrific fronts right now on this. Google is creating two specs, one to only let Attested devices through, and one to transmit government ID. So only users on devices they can't control, with id by government, can participate at all. This is what fear is bringing us to. People will welcome this hell. The end of the War Against General Purpose Computing will come with applause, from those who have been sold the message to be afraid.
Coproate controlled devices only: https://github.com/RupertBenWiser/Web-Environment-Integrity/...
Government ID required only: https://github.com/WICG/mobile-document-request-api
Or also see the Android Protected Confirmation API, https://news.ycombinator.com/item?id=35942710 https://security.googleblog.com/2023/04/secure-mobile-paymen...