The attestation object contains fmt, attStmt and the authenticator data. WebAuthn Level 3 defines the formats packed, tpm, android-key, android-safetynet (deprecated), fido-u2f, apple, none and compound. Relying parties request it with the attestation option (none, indirect, direct or enterprise); the default is none, and consumer platforms with synced passkeys usually return no attestation and an all-zero AAGUID.
Verifying attestation means checking the statement's signature over the authenticator data and client data hash, validating the attestation certificate chain against roots from the FIDO Metadata Service or the vendor, and matching the AAGUID. It is useful for enterprise and high-assurance deployments that must allow only certified hardware; for consumer sign-in it adds friction and privacy cost with little benefit.
"Attestation" also appears elsewhere with the same idea of a signed statement about a key or artifact: TPM and Android key attestation, YubiKey PIV attestation, and software supply-chain attestations (in-toto, SLSA provenance).