Apple already shipped attestation on the web, and we barely noticed
https://httptoolkit.com/blog/apple-private-access-tokens-attestation