From 9b6838eca6b6b68119cd96ce6e9502e2269ea3a1 Mon Sep 17 00:00:00 2001
From: Daniel Micay <danielmicay@gmail.com>
Date: Fri, 1 Apr 2022 20:13:55 -0400
Subject: [PATCH] document attestation provisioning server

---
 static/faq.html | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/static/faq.html b/static/faq.html
index 238d2bb7..9090d7f5 100644
--- a/static/faq.html
+++ b/static/faq.html
@@ -785,6 +785,19 @@
                             internet access and not being able to delay scheduled jobs depending
                             on internet access until it becomes available.</p>
                         </li>
+                        <li>
+                            <p>Connections are made to a server to provision attestation
+                            certificates for hardware-based attestation. GrapheneOS uses
+                            https://remoteprovisioning.grapheneos.org/ by default which is a
+                            reverse proxy to the https://remoteprovisioning.googleapis.com/
+                            service. Their service splits up the implementation of provisioning to
+                            preserve privacy, and our reverse proxy adds to that since it's unable
+                            to decrypt the provisioned keys.</p>
+
+                            <p>A setting is added at Settings ➔ Network &amp; Internet ➔
+                            Attestation key provisioning for switching to directly using the
+                            Google service if you prefer.</p>
+                        </li>
                         <li>
                             <p>DNS connectivity and functionality tests</p>
                         </li>