Explicitly state that RPs cannot in general choose attestation type/format

[emlun]

Fixes issue #1659.

Marking this as draft for now because I'm not entirely sure this addition is worth its weight. I'd like to hear what some others think.

---

Preview | Diff

[equalsJeffH]

Hm. I agree we ought to make it explicitly clear that the authenticator chooses the attestation type&format. However, the proposed statement confuses attestation type&format with attestation conveyance, which is a different thing.

[equalsJeffH]

thx @emlun, nominally looks OK to me, but I wonder about the "and client" portion of the clause:

[=attestation statement format=] is chosen by the [=authenticator=] and [=client=]

...is that referring to the "none" attestation conveyance case where the client modifies the returned attestation statement? If so, I'm inclined to excise the "and [=client=]" and then it LGTM.

[emlun]

That and the "indirect" attestation conveyance case. But yeah, we can probably just leave it at saying just the authenticator chooses. Any reader who wants to know more about attestation will easily find the exceptions to that anyway.

[sbweeden]

LGTM

[emlun]

Since @equalsJeffH commented:

nominally looks OK
[...]
I'm inclined to excise the "and [=client=]" and then it LGTM.

it seems like this is ready to merge. Thanks everyone!