ChromeOS does this really well with its platformKeys API on enterprise provisioned laptops, as it's tied in to the TPM so lets you unclonably idenfity a device from the browser