Challenge-response is the center
The server should issue challenges that cannot be replayed indefinitely. The app signs assertions, and the edge validates them before forwarding trusted traffic.
DeviceCheck adds another signal
DeviceCheck can complement App Attest for risk decisions, especially when products need persistent device-level abuse signals.
Keep observability boring
Teams need clear pass, fail, replay, and degraded-mode logs so security decisions can be audited without exposing sensitive app data.