It wouldn’t be a silent ratchet though. Attestations require a hardware-backed passkey, which makes them non-transferable. And you can’t convert a software-backed passkey into a hardware-backed passkey. So if your passkey is stored by a password manager that syncs, you’re good.
[Okay, technically it doesn’t have to be hardware-backed to be attested. But if it’s software-backed the attestation becomes of such low quality that it’s not accomplishing the goal anymore. When a device attests that the passkey is coming from device X running OS Y, but that exact same passkey is also synced to other devices running other OSes, the server loses most of the reason to trust that attestation.]
It wouldn’t be a silent ratchet though. Attestations require a hardware-backed passkey, which makes them non-transferable. And you can’t convert a software-backed passkey into a hardware-backed passkey. So if your passkey is stored by a password manager that syncs, you’re good.
[Okay, technically it doesn’t have to be hardware-backed to be attested. But if it’s software-backed the attestation becomes of such low quality that it’s not accomplishing the goal anymore. When a device attests that the passkey is coming from device X running OS Y, but that exact same passkey is also synced to other devices running other OSes, the server loses most of the reason to trust that attestation.]
The second half of your comment is basically what big tech companies do for a living.
What’s the point of half of the software standards they proposed, and bribed officials to accept them without addressing issues?
There is no point, other than money.