They can't fake the attestation from hardware implementations so you could just reject keys from software implementations.