Attestation isn't even the problem. I'd love to be able to verify that my server's kernel hasn't been tampered with.

The problem lies in companies like Apple/Google/Microsoft rejecting attestation that they do not control.

People confusing big tech's policy choices with tech features have made "I want my laptop's auth token to only be usable on my laptop" a controversial opinion.