[mooreds]

The FIDO alliance offers up a JWT with attestation data: https://fidoalliance.org/metadata/

But I agree, I don't think there's any enforcement mechanism beyond whatever the RP decide.