We don't need a signing authority. Those "attestations" are are anti-user security theater. We need to stop requiring apps for everything. The internet was designed to be used in a browser that can run anywhere. 2FA can be done with simple texts or phone calls.

GrapheneOS does have their own device attestation sdk

Imagine the outcry. That would go against everything OS stands for, wouldn't it?