Feature: Add Passkey Attestation

Feature description

Passkey attestation is a process that verifies that a key presented during registration was created and protected by a genuine authenticator with verified characteristics. This ensures the authenticity and integrity of the authentication process. Currently, the AAGUID information of the passkey supplied during registration is not cryptographically verified.

The FIDO MDS (https://fidoalliance.org/metadata/) contains metadata that includes certificates that can be used to form a chain of trust that ensures that a passkey was generated on the hardware of a specific vendor/authenticator model.

I have implemented a first rough draft of how this could look like in Pocket-ID here, but am not sure if that fits the overall goal/design philosophy of the project: https://github.com/NoRelect/pocket-id/tree/feature/passkey-attestation

Design questions that are worth discussing in my opinion:

• How to get the FIDO MDS data? Periodically fetch it from remote, just like with geo ip data, or store it locally/ship it with pocket-id (how AAGUID info is currently handled)
• What should be the default option regarding the attestation request? If we disable it by default, enabling it later will cause all already registered (unattested) passkeys to no longer be usable. If we make it optional by default, the additional popup asking about supplying info about the authenticator will show up during every passkey registration, even though it might not be needed.

Pitch

I want to be able to restrict the passkeys that can be used to authenticate to a minimum FIDO certification level or be even more specific and only allow specific passkeys from vendors that I trust:

Registered passkeys with attestation then show the authenticator model/vendor if verification was successful: