> bad actors can use attestation technology to do all sorts of user-hostile things

Not just can. They will use it.