Yeah, I think that’s a good explanation. It’s like a captcha for your device and it’s the underlying OS that handles the attestation.

The downside with this is that there will be a walled garden where custom devices are not allowed access too.