> The obvious way to satisfy people is to remove support for remote attestation from the spec.

If you presume bad faith on the part of basically the entire WebAuthn implementer community, how does this help?

The consumer passkey authenticator implementations of today do not provide attestations, passkey relying parties do not consume them, and both would need to intentionally ship changes to enact the scenario you're worried about. If you're worried about both of these colluding to lock you out of your accounts, it seems naive to think that changes to an (intentionally malleable, extensible) spec will protect you.