> because the browser has zero idea where these bytes can go after they hit the socket
The attestation uses a secure enclave in your processor with a secret key you can't access to verify that secure boot is on, you booted a signed OS, the OS is in locked-down mode, etc.