"The challenge is based on device attestation and what’s new in this case is the arrival of a third party, the attestation server."