Whether or not attestation data is passed onto the browser is a decision the passkey provider can make.