Given the risk of abusive, inappropriate or coercive requests for high assurance credentials, the ability to report abuse is important for accountability of usage of the API.

Reporting could include to the browser vendor or to some browser-consumed safety service, but also to the relevant data protection authority or registry or auditor/trustmark provider if those trust assurances are also documented or provided.

https://github.com/w3c/credential-considerations/blob/main/credentials-considerations.md#reporting-abuse