Comment by lvass

You can maybe, trust the user to handle it's own certificate in their own devices? Though I admit requiring attestation is probably a good default.