[lxgr]

There's a relatively simple and much more open and secure solution to this: Make physical EU ID cards the attestation source, and require users to tap them against their phone for critical operations (high-value signatures, login on a new device or after repeated authentication failures etc).

That would solve the open hardware/OS "problem" on the device entirely, as there's no trusted hardware or OS signature required anymore. You could argue that this adds the possibility of a MITM attack on the phone (since you don't know what you sign anymore or who you are providing with your PIN, as the card has no display and no PIN pad), but I wonder if mitigating this is worth all the lock-in concerns that phone attestation goes hand in hand with.

As it is, all EU ID cards already have mandatory strong cryptographic authentication, but in a form that's usable only for in-person ID checks (under the corresponding ICAO biometric identity document standards), not for remote ID attestation. This is frustratingly close, but not what's needed.

[LelouBil]

My French ID card has the features, but also the French digital ID app also requires Play Integrity...

[xpuente]

How can you have a secure enclave without hardware attestation? Processor root-key is the source for all.

[lxgr]

Smartcards have attestation too.

[xpuente]

But how can you verify that the processor's own software, which ultimately runs the application, has not been compromised?

[lxgr]

The software running on the smartcard? You write that yourself, and hopefully your security processes are good. The nice thing about smartcards is that the trusted computing base is massively smaller than that of a regular operating system.

If you disallow installing applications post-issuance (which is probably a good idea for ID cards), you don't even have to worry about VM runtime integrity either, as there will be only your application running on the card.

[okanat]

Processor's software becomes no different than a switch, a transfer medium in the network when you use the smartcard capabilities of the EU ID card. Digital signatures and cryptography happens purely inside the RFID/smartcard chip of the card.

This is how payments work for chip-and-pin system of EMV and login and signing systems of many businesses in the EU already. There is no need for third party attestation already.