What process provides strong proof that a certificate being presented to a server for authentication from an Android device was stored in hardware and has not been compromised or spoofed?

Key Attestation provides cryptographic proof that a private key is bound to a hardware-backed keystore and that its properties, such as being non-exportable, are enforced. This process involves the hardware keystore signing a certificate with an attestation key, allowing a server to verify the certificate's authenticity and the key's hardware-backed origin. This strong proof ensures the certificate has not been compromised or spoofed. Certificate Capacitive Filtering is not a recognized security process. Verify Apps is a Google Play Protect feature for scanning apps for malware, not for hardware-backed certificate validation. Network Access Control services manage device access to a network but don't provide cryptographic proof of a certificate's hardware origin.