There's a lot of public keys that don't give you any special access, unless the dev is really bad.
Anyone who cares about security will be using App Attest or the Google store equivalent.
> Anyone who cares about security will be using App Attest or the Google store equivalent.
Why? I rarely have security objectives where remote attention would help, and it has a huge impact on user freedom. For B2C attestation is just an evil captcha.
>Anyone who cares about security
I have something hilarious to tell you about IoT apps