Apple already shipped attestation on the web, and we barely noticed
But signing necessarily is happening on the user&#x27;s device... what is to stop brave&#x2F;etc from also signing their outgoing requests with the same key your local Chrome install is using? On a mobile device I can see how this would work but how would this ever work on (non-apple) PCs without exposing the key to anyone willing to poke around a bit?