And what attestation services does your web app use? Do we lock that web app behind having Secure boot enabled, along with a Java applet for the fun of it?

If your answer is "none", you missed the point.