Authenticators are the easy half. TOTP is a written standard: any app that implements it derives the same digits from the same seed, and the employer never learns which one you picked. Attestation is the hard half. Banking and DRM apps ask the device whether it is certified; who is holding it never comes up. That check fails on a de-Googled phone whatever app you installed, and no store replacement repairs it.