We don't need a signing authority. Those "attestations" are are anti-user security theater. We need to stop requiring apps for everything. The internet was designed to be used in a browser that can run anywhere. 2FA can be done with simple texts or phone calls.