WebAuthn Attestation purpose and neccessity is incorrect

### MDN URL

https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion

### What specific section or headline is this issue about?

Attestation

### What information was incorrect, unhelpful, or incomplete?

(Emphasis added)

> The purpose of attestation is to cryptographically prove that a newly generated key pair came **from a specific device**. This provides a root of trust for a newly generated key pair as well as being able to identify the attributes of a device being used (how the private key is protected; if / what kind of biometric is being used; whether a device has been certified; etc.). It should be noted that while attestation provides the capability for a root of trust, **validating the root of trust is frequently not necessary.**

### What did you expect to see?

(Changes in bold)

> The purpose of attestation is to cryptographically prove that a newly generated key pair came **from a specific device model or batch**. This provides a root of trust for a newly generated key pair as well as being able to identify the attributes of a device being used (**the provenance of the device;** how the private key is protected; if / what kind of biometric is being used; **what PIN complexity requirements apply;** whether a device has been certified; **whether it has been recalled for security defects;** etc.). **Verifying a credential's attestation is necessary to [prove it is a self-contained multi-factor credential](https://www.w3.org/TR/webauthn-3/#sctn-authentication-factor-capability).**

### Do you have any supporting links, references, or citations?

[Without valid attestation, credentials cannot be proven to be multi-factor](https://www.w3.org/TR/webauthn-3/#sctn-authentication-factor-capability:~:text=The%20authenticity%20of%20the%20UV%20flag%20can%20in%20turn%20be%20assessed%20by%20inspecting%20the%20authenticator%E2%80%99s%20attestation%20statement%2E) - they only prove "something you know" (a credential's private key).

[A multi-device credential can be copied](https://www.w3.org/TR/webauthn-3/#sctn-credential-backup). The user verification bit on these credentials cannot be trusted.

A hardware authenticator that has known security defects can also not be trusted to protect its key material or enforce user verification restrictions.

A credential can only be trusted as a self-contained multi-factor credential by verifying the attestation at registration time, and periodically revalidating attestation (if that was revoked due to defects).

### Do you have anything more you want to share?

_No response_

### MDN metadata

Page report details

* Folder: `en-us/web/api/web_authentication_api/attestation_and_assertion`
* MDN URL: https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API/Attestation_and_Assertion
* GitHub URL: https://github.com/mdn/content/blob/main/files/en-us/web/api/web_authentication_api/attestation_and_assertion/index.md
* Last commit: https://github.com/mdn/content/commit/941ade970fd7ebad52af692b6ac27cfd96f94100
* Document last modified: 2025-05-28T14:25:52.000Z

Open files/en-us/web/api/web_authentication_api/attestation_and_assertion/index.md and locate the Attestation section. Read the linked WebAuthn specification references before assessing the proposed wording and its claims about attestation, multi-factor credentials, and credential backup. Done means the section accurately reflects the agreed WebAuthn guidance and retains appropriate supporting links.

Written by the indexing model from the issue text.