Our growing userbase and Motorola partnership will give us a lot of sway to get apps to allow GrapheneOS. We can't realistically convince banks, governments and other companies to stop requiring attestation. We can realistically convince most apps to allow GrapheneOS via hardware attestation since it supports doing it via the standard Android key attestation API. We cannot realistically convince apps to not adopt attestation unless they implemented it without truly wanting what it provides which is unlikely for service-side integration. We've only convinced a couple apps to stop using the Play Integrity API. However, we've convinced a growing number to permit GrapheneOS alongside permitting Google-certified operating systems.

Regulators should force Google to stop further closing up Android and to permit alternate operating systems to pass the Play Integrity API device and strong integrity levels. It should not require certification by Google and complying with their arbitrary requirements based around their business model. There should be another path to obtaining certification without Google's involvement where Google has to respect it and permit those devices and operating systems to pass. Most important is stopping them from closing things down more against the original terms they provided Android and gained market share with it. Next most important is a reasonable path to alternatives passing the Play Integrity API based on security standards which do not block updates while waiting for certification.

We don't think it's realistic to stop apps adopting attestation but people should try regardless. A single country with a large market banning would make a huge difference.

https://grapheneos.org/articles/attestation-compatibility-gu... is our guide for app developers on permitting GrapheneOS via hardware attestation. Other operating systems can publish signed keys in a similar way to enable easily supporting them once this is implemented. An organization certifying operating systems could collect these and sign an overall list. It would also be possible to support a broader hardware ecosystem with alternate roots of trust by providing a signed list of those too. This is not the future we want but it is the future we believe we can obtain through a lot of pressure. We would greatly prefer apps not making an allowlist of operating systems. People should be able to make their own GrapheneOS build and use the same apps.