The source for this is 5 months old. It’s based on a paywalled Financial Times report called “Banks seek to offload risk to avoid ‘choking’ on data centre debt” from May 3, 2026.

It wouldn’t be a silent ratchet though. Attestations require a hardware-backed passkey, which makes them non-transferable. And you can’t convert a software-backed passkey into a hardware-backed passkey. So if your passkey is stored by a password manager that syncs, you’re good.

[Okay, technically it doesn’t have to be hardware-backed to be attested. But if it’s software-backed the attestation becomes of such low quality that it’s not accomplishing the goal anymore. When a device attests that the passkey is coming from device X running OS Y, but that exact same passkey is also synced to other devices running other OSes, the server loses most of the reason to trust that attestation.]

This is FUD about passkeys. The core issue they have is with attestations. Well servers already have ways to require attestations that don’t involve passkeys.

Maybe there’s some strong arguments against attestations, but I haven’t seen them. All I’ve seen is people arguing that attestations make it hard to violate sites’ terms of use or to evade bans.