drop android keystore attestation cert chain · parse + verify · runs locally
drop android keystore attestation cert chain · local only
heuristic screener · vendor schema varies · not definitive proof