and the attestation server would definitely be from Google. Google's document pinky-promises the company doesn't want to use this for anything evil. The authors "strongly feel" the API shouldn't ...