The attestation is part of the webauthn spec, and it's up to the relying party to decide whether or not to use it. The whole reason it's there is to give some contexts the ability to narrow their users down to specific webauthn storage implementations (which is useful in some corporate / gov contexts).
Are there any examples of any widely-used sites that are enforcing attestation?
Are there any examples of any widely-used sites that are enforcing attestation?