Key attestation
A signed statement from the hardware that a particular key was generated inside it and cannot be exported.
A public key tells you nothing about where its private half lives. It might sit in an HSM, or in a text file on someone's laptop. With attestation, the module issues a statement about the key's properties, such as generated on-device and marked non-exportable, and signs it with a device key whose certificate chain leads back to the manufacturer.
Certificate authorities use it to check that code-signing keys really live in hardware, which the CA/Browser Forum has required since 2023. YubiHSM, the cloud HSM services and Android Keystore all offer variants. Trust still hinges on the manufacturer's root key, so attestation moves the question "why should I trust you?" one level up rather than answering it.