I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.

At this point in time it’s not a problem, but how can we know it won’t be in future?