Comment by grapheneos

GrapheneOS is open source with reproducible builds. Android key attestation isn't specific to GrapheneOS and is OS independent. It mainly exists to check that a key was generated in a hardware keystore. There's no pass or fail based on having an official or unofficial build of GrapheneOS. The hardware can sign public key certificates with metadata on device security including verified boot state (green, yellow or orange), verified boot key hash, verified boot hash (hash of the core OS) and patch levels. That's not nefarious and is useful to end users. Our Auditor app uses it to help users protect their devices. GrapheneOS doesn't use it to require people to use an official build for any purpose. Some banks have regulations requiring them to verify the hardware, OS and app which means they need to specifically allow each non-Google-certified OS. There are only around 3 banking apps are known to permit GrapheneOS that way and without it they'd ban using any non-Google-certified OS.