I’m no legal advisor. But my opinion is that it is possible for any code to be misused. If you have a legitimate use case for your own purpose that is compliant with the law, isn’t it possible that the screen capture protection code is (in that scenario) being misused?

Seems like a strong argument for dedicated hardware to me. Something card shaped 😉

I don’t think I understand this. I don’t actually want to pay with my phone, so thats a non-problem to me, but when I can access my bank with a browser on any pc in the world, why do they need attestation on a mobile? I dont see why the requirement is inconsistent.