So get them to remove support for device attestation from the spec, or don't use passkeys.