Post #2843618

@navi@social.vlhl.dev @lumi@snug.moe And to your last point: I've already answered that. Runtime assertion is required to attest, the attestation from hardware key store is from within their untampered app, otherwise MITM could relay to any other device. One could work around this by paper verificaton process (i.e. the bank print our revceived public key fingerprint and sens it back to you with a verification password, you have to type in to complete key binding)