I halfway expect a v2 specification where keys are only stored on a few "Certified Attestation-capable" providers (i.e. facebook, google, apple, amazon)

Then watch them get hacked through a systems management plugin like Clownstrike, or Solarwinds.