This is already in the spec. It's not some faraway hypothetical, they could start requiring this tomorrow if they wanted to. And if you're capable of seeing any trends wrt the 'attestation' and 'securing' everything that are already here, you will know that all they're waiting for is for a significant enough portion of users to get passkeys on their platforms naturally, and then just force everyone else.