Oh dear, I should have clarified what I meant by "identity" here.
By "attesting to ... the person who owns it", I mean to talk about "identity" in the precise sense of "identifying" the relative physical location of whatever entity happens to be in control of some particular key material issued and registered a priori at some secure location. (That is, a supercomputer can bruteforce many kinds of strong cryptography eventually... but unless P = NP, it's not happening quickly. The odds are literally astronomical that one would be able to guess the right answers correctly and quickly. So we can all rest assured that anyone who can make it through a zero-knowledge proof protocol within reasonable time limits must physically control certain private key material).
Again: I am not talking about "identity" in the usual everyday sense of identifying some particular human being.
A better way to put it would be something like "SIM cards, but for cameras". You could even use similar terminology to what LTE has:
- IMSI (International Mobile Subscriber Identity) := the smartcard from your cell carrier which lets you use a particular phone number on their network. (For the camera use-case: you would subscribe to an attestation service that will vouch for your photos. The service would issue you a phone-number-like "subscriber number", perhaps via SIM smartcard, u2f dongle, or other physical "key")
- IMEI (International Mobile Equipment Identifier) := the network-specific serial number that device manufacturers issue to each device, in addition to the regular "make-and-model" serial number that one might expect. The function of the IMEI is to label a particular physical device as end-user equipment that can participate in the attestation system. (It also comes in handy to support anti-theft blocklists in the event that user equipment is stolen, and some nefarious third party attempts to connect later).
Note that in the case of LTE devices: it is possible to clone a SIM or steal a mobile device. Fortunately, the IMSI + IMEI combo gives cellular carriers enough information to do something reasonable in those situations. For the camera use-case, an attestation service could similarly do their part: 1. Refuse service if the request IMSI is associated with a spam dialer, a closed account, or a nonpaying subscriber (whose service has been shut off); 2. Refuse service if the request IMEI is associated with a stolen device.
Again, it doesn't give you the usual notion of "identity". But (in theory) it ought to give you something similar to the notion of an in-service phone number.