On: Unpacking Google’s Web Environment Integrity specification

[butz]

How about adding a fair rule to standard, that attester cannot attest their own products? I wonder how long would it take for Microsoft or Apple to attest google.com as trustworthy website?

[pptr → butz]

The attestation is about the device, not the website.

I think just from a security perspective it makes most sense for the device or os manufacturer to handle attestation for that device.