>- The web page executing in a user's web browser
>- A third party that can “attest” to the device a web browser is executing on, referred to as the attester
>- The web developers server which can remotely verify attestation responses and act on this information.
Chome only for now but I imagine after it's pushed to Chromium and all the browser based on that Mozilla will implement it too (just like all the other DRM FF has now).