A passkey sign-in proves control of a credential. An organisation may also want to know something about the authenticator that created a credential. Those are related questions, but they are not the same question.
In WebAuthn, attestation can provide information about the authenticator during credential registration. Authentication later uses an assertion tied to the registered credential and the current challenge. A successful sign-in should not be described as a fresh inspection of every property of the device.
Provenance is not the user’s identity
An attestation statement may support a policy about acceptable authenticator types or provenance. It does not, by itself, establish a person’s legal name, employment status or entitlement to an account. Those decisions require the relying party’s separate identity and access processes.
The W3C WebAuthn specification also discusses attestation privacy. Certificates and keys can create tracking or linking concerns, and mechanisms such as batch attestation are intended to limit identification of individual authenticators.
For a hypothetical organisation, compare two policies. A public discussion site may not need device-provenance evidence at all. A tightly controlled administrative system may have a documented reason to accept only specified authenticators. Copying the second policy into the first system can add friction and privacy costs without answering a real requirement.
Write the requirement before requesting evidence
An administrator’s checklist should state what property is needed, which evidence supports it, what happens when evidence is absent, and how replacement or recovery works. Test the experience with the actual browsers and authenticators the users have.
Do not assume that a missing attestation statement means a credential is fraudulent. Nor should the presence of one justify skipping ordinary server-side WebAuthn validation. Attestation is one policy input within a registration design. Keeping its purpose separate from sign-in makes both the security decision and the privacy explanation easier to defend.