IETF is standardizing a new ACME challenge called device-attest-01 that enables organizations to provision device-bound certificates to machines with non-extractable signing keys, useful for mTLS scenarios requiring strong device identity. attezt is a Linux toolkit providing an ACME client, attestation server, and PKCS11 agent to support this new challenge.