Passkey attestation hands control of the client software to the website. Since surveillance capitalism funds most of the web, this means that, over time, the only approved clients will be surveillance devices, and those devices will slowly add more and more invasive spyware.

Initially, they will probably “just” require hardware serial numbers or similar (so they can join IDs on the backend).

There are already serious proposals to require live web cam feeds for porn site login biometrics purposes, so I can’t really come up with any hyperbole to add.

They need you to prove you have the private key. They don't need to know what kind of phone you're using etc.