This was the first time I've encountered App Attest and it seems like a pretty solid solution to the problem of having to trust that a request from someone else's device is in fact originating from your own app rather than an extracted key of some form.