WebAuthn attestation statements (WebAuthn Level 3, sections 8.2 and 8.7).

verify/2 checks the attestation statement of a new credential:

• none: an empty statement; nothing is claimed about the authenticator. Synced passkeys (Apple, Google, password managers) send this.
• packed without x5c (self attestation): signed by the credential's own key, with the credential's algorithm.
• packed with x5c: signed by the leaf certificate with an alg that fits its key, the leaf meeting section 8.2.1 (version 3; subject with C, O, OU=Authenticator Attestation and CN; Basic Constraints with CA false; an AAGUID extension, when present, not critical and equal to the credential's) and chaining to one of the attestation_roots (DER) you configure.
• any other format: refused, or reported as unattested when allow_unattested => true.

With attestation_roots set, only the last kind is accepted: none and self attestation say nothing about the authenticator, so they are refused as {untrusted_attestation, none | self}, unless allow_unattested => true.

Deviations: only none and packed are verified, and the FIDO Metadata Service is not consulted. See AGENTS.md, Known deviations.