Indeed. As I understand it AOSP does have its own attestation
To gain benefit from the use of this would require Murena to operate full disclosure on their keys to allow pressure on any organisations that might be prepared to accept “alternative” attestation.