GrapheneOS on Nostr: Our Auditor app generates a hardware backed attest purpose key for each pairing with ...

Our Auditor app generates a hardware backed attest purpose key for each pairing with attestation enabled via the root-based attestation system. It then generates a regular hardware backed signing key with attestation enabled with the attest key it generated as the attestation signing key. It signs the overall messages it sends with that signing key. On subsequent attestations, it makes a temporary unused key with the same attest key for signing it to get fresh attestation data.