Integrity verification and immutability doesn't need to be implemented through attestation. Attestation is a horrible concept used by companies to dictate you what you can and what you can not use on your hardware.

Attestation has nothing to do with security.

First, because attestation doesn't enforce any security standards by default, it just requires an "official" hardware-software stack. It may be used for such enforcement, but no one gives a shit, including Google with their Play Integrity Protection that allows immensely outdated devices to be accepted as "secure".

Second, because one leaked key, and all the devices signed with that key immediately become a security circus. Yes, eMudhra way.

Banking software

Banking software is an absolutely horrible thing both security-wise and privacy-wise. Having it on Linux is exactly the opposite of what Linux needs.

Do we have a choice?

Yes. Do not use anti-consumer tech. Do not use services that require such anti-consumer tech. Demand from your banks and your government support for open technologies and standards (literally W3C-compliant web browsers are enough for practically anything).

I do realize that it's extremely difficult and barely possible at all. But bringing that crap to open ecosystems is not the answer.