Why does this article claim that attestation is unlikely? We know Google loves the idea - see Web Environment Integrity (WEI).
Also, what's stopping us from falling into the passkey version of the world we got with OpenID, where many services force you to log in with your BigTech account?