Remote Attestation TLS (RA-TLS)
What&#x27;s the advantage (I can&#x27;t see any) of this scheme over using client certificates where appropriate?<p>It seems to me that the &quot;attestation&quot; doesn&#x27;t add anything (other than the ability to positively identify a device across multiple sites, which is a downside rather than an advantage) to the TLS session set up process.<p>If a site (i.e., a corporate VPN) needs to ensure that a particular client is authorized to access it, client certificates <i>and</i> user authentication already provide such confirmation.<p>I don&#x27;t see why this is necessary for sites that, while they  may wish to encrypt sessions with TLS, don&#x27;t have any reason to track (and potentially block) devices that don&#x27;t possess the properties (e.g., no ad blocker) they want to see.<p>ISTM that this is antithetical to the peer-to-peer nature of the Internet and is just another way to restrict access for those who are deemed to be acting against the financial interests of large corporations.<p>I have no interest in donating my CPU cycles and bandwidth to those who want to identify&#x2F;categorize&#x2F;advertise&#x2F;restrict my access to the open internet.<p>This could also kill off tools like curl, yt-dlp and other non-browser tools.<p>Altogether a terrible idea.  Or am I missing something important?