You're conflating 2 different concepts. Attestation comes in many shapes and the AOSP version of attestation is based on x.509 cert chains and manufacturer roots. The only part of that owned by Google is the revocation list.
Play Store Attestation makes it all a lot simpler to use as a developer as it handles all the fiddly bits of cert attestation and also does PlayStore based app integrity checks.
Not using attestation isn't an option: we've seen in-the-wild attacks on our service using rooted devices and modified APKs.
We've implemented the lowest LOE attestation, but the more I'm learning about the AOSP standard the more I'm interested in pivoting, at least for Graphene support.
Play Store Attestation makes it all a lot simpler to use as a developer as it handles all the fiddly bits of cert attestation and also does PlayStore based app integrity checks.
Not using attestation isn't an option: we've seen in-the-wild attacks on our service using rooted devices and modified APKs.
We've implemented the lowest LOE attestation, but the more I'm learning about the AOSP standard the more I'm interested in pivoting, at least for Graphene support.