The increasing sophistication of presentation attacks, deepfakes, and credential-theft techniques has exposed fundamental weaknesses in traditional authentication and identity assurance mechanisms used in enterprise environments. This paper proposes a convergent authentication architecture that tightly integrates FIDO2/WebAuthn public-key, certificate-based authentication, and device attestation to construct a phishing-resistant, scalable identity assurance framework for large organizations. By synthesizing standards-driven cryptographic mechanisms with device-level provenance and attestation evidence, the architecture aims to mitigate social-engineering, credential replay, and device-compromise threats while preserving usability and manageability for enterprise deployments. We detail the theoretical foundations—covering asymmetric cryptography, attestation models, and human-centered usability concerns—explain the operational mechanisms for binding keys to devices and identities, and specify an end-to-end lifecycle for credential issuance, revocation, and continuous assurance. The study draws on empirical and normative literature on biometric presentation attack detection, deepfake vulnerability, device attestation taxonomy, digital identity lifecycle guidelines, and recent work on FIDO2 usability and applicability to enterprise settings. We then analyze security properties, potential adversary models, deployment trade-offs, privacy considerations, and governance implications. Finally, limitations, operational challenges, and a research agenda for measurement, standardization alignment, and large-scale pilot evaluation are discussed. This integrated approach is positioned as an actionable pathway for enterprises seeking to significantly raise the bar against phishing and device-origin attacks while aligning with contemporary identity and cryptographic standards.