> a maintainer confirmed that hardware-bound attestation is a mandatory architectural requirement

Hardware-bound is not a problem, limiting that to only iPhones and some Android phones is. Plenty of hardware can keep a key safe and it doesn't need Apple's or Google's blessing.