This. Plus if I want to access my bank account on a device I trust, the bank shouldn’t say “hey we don’t trust it so buzz off”. It’s my money in that account.

I understand there’s some stupid compliance thing that makes banks do this, but it clearly isn’t a hard requirement, as there’s still plenty of banks that don’t participate in this security theatre.

I am talking about attestation in general. I already left a comment in the thread agreeing with you.

They allow old devices to report to Play Integrity. That doesn't mean the service provider requesting attestation has to allow such devices. These things usually give just a risk grade to the service provider and it's up to them to make the decision.

Graphene OS says they are secure, but the definition of secure they're using isn't the same one the service providers are using, so that doesn't help much.

The best route forward here is to push for a separation of certification types. Ideally it would be possible to pass the security related aspects of Google's CTS test suite and get approved by Play Integrity without triggering the other parts of Android certification.

>QubesOS, Whonix stations, you name it. I'd argue they are far more secure than any average windows/macos installation.

OK, then let's see you argue it.

Most of the people who claim Linux is more secure have simplistic one-sentence arguments (e.g., "Linux is open-source, and many eyeballs make bugs shallow including bugs that are security holes") whereas those who say that MacOS and ChromeOS are more secure go into great technical detail as to why they think that.

Graphene supports attestation and any backend service can add support for handling it. No one is forcing people to only use two.