After I first skimmed the specs, I had thought it would require constant check-ins with the attestation provider. Apparently, you need to get the attestation installed only once. I have trouble seeing how that could work out.

So a kid gets a phone from some cool older brother or an unaware grandpa. What stops them using that single phone to verify everyone in school?

Of course, the kids might not bother when you can just use a VPN or some non-compliant, foreign service.