“Hardware-bound attestation is a requirement of this project, not an implementation detail we can simply drop,” a maintainer responded. The project invited alternative architectural proposals and said a dedicated security review and threat model would be published soon.
I swear to god the EU always strengthens the iOS/Android Duopoly they claim to fight.
Using hardware attestation won’t achieve anything when it comes to age verification. It will lock people into using iOS or Google certified Android for those apps. Governments apps in the EU are among the worst offenders for banning using alternatives to iOS and GMS Android.