"The standard hardware attestation API can be used to verify the authenticity/integrity of the hardware, firmware, OS and the app running on it. It provides a verified boot key fingerprint for the OS for permitting secure aftermarket operating systems. The app ID, signing key fingerprint(s) and version code of the app enabling hardware attestation are included in the signed public key certificate for the generated key. This enables the app's service to make sure the app is genuine and unmodified along with chaining trust through the OS to the app which can sign messages with the attested hardware keystore key to prove they come from their app running on top of a verified OS, firmware and hardware. The only practical way to bypass hardware attestation is through exploiting the hardware keystore to obtain attestation signing keys, which is protected against by the ability to revoke keys that are being misused. "

I don't support the age verification stuff at all.

But a question:

I found this apk-file on their official GitHub, a demo version of the age verification app.

Does this mean the official app, when it's released and if it's released as apk-file, can be downloaded outside the google/apple ecosystem using any phoneOS of your choice?

AOSP-based or Linux distros using the Waydroid-thingy?

And if they can publish the demo version as apk, why not then the e-wallet, when it comes, too? Using various places for apk:s is how I update certain apps today using Obtainium.

(This is an honest question, not a *statement* of how the app can be downloaded.)

"app-demo-release.2026.04-1.apk"

https://github.com/eu-digital-identity-wallet/av-app-android-wallet-ui/releases/tag/2026.04-1

This hardware attestation is Android-specific, but at least not tied to Google. That fixes a major problem for a major platform. One still needs a solution for serving the rest of the market in a similarly acceptable way, of course.

So, if we take that seriously, and considering that this is just the start, then I guess we can later expect a desktop application, or even a website, that does exactly that: Trade usability for portability.

Similarly to how the ID Austria is handled: You can either use the Android/iOS app (easy to use, non-portable), or use a FIDO token (portable, but worse usability).

Since age verification is going to be a gate-keeper that will lock out everyone who does not have access to a verification tool from large parts of the internet, I think it is at least worth considering the "worse usability" option as an alternative for users who do not have access to an Android/iOS phone with Device Attestation.

Which also is system-specific and therefore not portable.

What we are dealing with is a trade-off between usability, security and portability. The current approach emphasises the first two strongly over the third.

Since this is a gate-keeper app, where everyone who does not have access will also not have access to certain websites, I think a higher priority should be given to portability, even if it lowers usability or security.