what makes passkeys any different from all the other times they have embrace, extend, extinguished? what, fundamentally, stops them from using attestation in the exact way the user described? specifically, what stops the following scenario from playing out?

1. passkey support becomes commonplace across the web
2. many websites stop using passwords due to their inherent security issues
3. most users (for brevity, say 90% or more) just use their OS to store passkeys because it's easier
4. apple provides attestation for passkeys stored in the Secure Enclave
5. google provides attestation for whatever their business goals are
6. google refuses passkeys that aren't attested due to their "security issues"
7. apple does the same, which has the added benefit of killing devices without a Secure Enclave
8. maybe PCI-DSS requires attested passkeys because of "security issues"
9. maybe financial institutions require attestation (similar to the ctsProfileMatch issue with GrapheneOS)
10. 90% or more of users don't notice or care about steps 4-9
11. most of the 10% or less need to use at least one account that requires such an attested passkey
12. idk what happens with firefox but i'm sure many firefox users (including me) have encountered a website that could work with firefox but chooses not to (based on User-Agent or similar)

obviously that isn't the only scenario one could envision but i don't really see what makes this one unreasonable to expect