At the moment, removing federations does not consider Attestation Policy Bindings (APBs). It rather should as it leaves a broken config.
There are two ways to go:
- remove APBs with the removed federation (simpler)
- block federation removal if APBs still reference it (safer, analogous to removing APs being blocked by existing APBs)